Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests to the Azure Instance Metadata Service (IMDS) IP address (169.254.169.254) with the URI containing 'metadata/instance'. This activity indicates an attempt to discover information about the Azure virtual machine instance, which can be a legitimate administrative action or an adversary attempting to collect credentials and other sensitive data.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.
This rule detects potential session cookie theft and bulk cookie exfiltration by monitoring HTTP traffic for large cookie sizes (greater than 500 bytes) being sent from the internal network to external servers. A threshold of 20 such events within 60 seconds from a single source IP triggers the alert, indicating suspicious activity that could be related to an attacker exfiltrating stolen session cookies.
This rule detects a PowerShell Empire C2 beacon pattern over HTTP. Specifically, it looks for HTTP POST requests to '/index.jsp' where the client body contains a base64-like encoded string of at least 200 characters, indicated by the PCRE pattern. This pattern is characteristic of how PowerShell Empire agents communicate with their command and control server.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
This Suricata rule detects potential internal RDP session hijack attempts. It triggers an alert when there are three or more established TCP connections to port 3389 (RDP) on the home network, originating from within the home network, within a 30-second window, tracked by the destination IP address. This pattern could indicate an attacker attempting to take over an existing RDP session or rapidly establish multiple RDP connections internally.
MSSQL Database DROP Destruction
Suricata
This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
This rule detects an active IP block scan by monitoring TCP SYN packets. It triggers an alert if more than 100 SYN packets are observed from a single source IP address within a 10-second window, indicating a potential reconnaissance activity where an attacker is scanning a range of IP addresses to identify live hosts or open ports.
Page 173 of 211