Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects a drive-by download attempt initiated via a malicious advertisement. It specifically looks for HTTP responses to clients where the HTTP referer header contains common advertisement-related keywords (ad., ads., advert) and the response body contains the 'MZ' magic bytes, indicating an executable file download. This combination suggests a user was redirected from an advertisement to a site that then attempted to download an executable.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects potential command and control (C2) communication originating from a compromised serverless function. It specifically looks for HTTP POST requests with a body size greater than 500 bytes, targeting domains associated with serverless platforms like Vercel (.vercel.app), Netlify (.netlify.app), and Cloudflare Pages (.pages.dev). A threshold of 10 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible high-volume data exfiltration or C2 activity.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
This rule detects a brute force attempt against a cloud management console. It triggers when a source IP address makes 10 or more HTTP POST requests to a URI containing 'signin' within a 30-second window. This pattern is indicative of an automated attempt to guess credentials for a login page.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects the use of a code signing certificate that is suspected to be stolen. It specifically looks for HTTP traffic where the TLS certificate subject contains an organization name matching a common corporate naming convention (e.g., 'O=Company Inc', 'O=Company LLC', 'O=Company Ltd', 'O=Company Corp') and the issuer is 'DigiCert'. This combination suggests a potentially legitimate certificate being used in an unauthorized context, possibly for signing malicious software.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
Page 182 of 211