Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects web path fuzzing activity by identifying the 'dirsearch' string in the HTTP User-Agent header. Dirsearch is a common tool used for discovering web directories and files, often employed in reconnaissance phases of attacks or security assessments.
This rule detects HTTP traffic where the User-Agent header contains the string "Burp" (case-insensitive). This is indicative of traffic generated by Burp Suite, a popular web vulnerability scanner and proxy tool. The rule specifically looks for traffic flowing from the internal network to a server.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
Supplier Chain Page Enumeration
Suricata
This rule detects potential enumeration of supplier-related pages on a web server. It triggers when a client makes 15 or more HTTP requests containing the case-insensitive string "supplier" in the URI within a 30-second window. This behavior could indicate an attacker attempting to discover sensitive information or entry points related to an organization's supply chain.
This rule detects bulk access to the 'about-us' page on a web server. It triggers an alert if a single source IP makes 15 or more HTTP requests containing 'about-us' in the URI within a 30-second window. This behavior can indicate reconnaissance activity, where an attacker is rapidly enumerating or scraping information from a company's public-facing web pages.
This rule detects network connections to known exploit sales platforms such as exploit.in, 0day.today, and leakbase. It specifically looks for HTTP traffic where the host header matches one of these domains, indicating potential access to marketplaces for exploits and zero-day vulnerabilities.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
This rule detects bulk scraping of 'team' or 'roles' pages on a web server. It triggers an alert if a client makes 15 or more HTTP requests containing 'team' (case-insensitive) in the URI within a 30-second window. This behavior is indicative of reconnaissance activities, specifically collecting information about an organization's structure or personnel.
This rule detects the download of common Remote Access Tools (RATs) such as AnyDesk, TeamViewer, UltraViewer, RustDesk, and Zoho Assist. It specifically looks for these keywords in the HTTP URI during client-to-server HTTP traffic. The rule is categorized as 'trojan-activity' and is intended to alert when a user might be downloading these tools, potentially after social engineering or phone contact, as suggested by the rule's message.
Page 185 of 211