Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to access typosquatted domains commonly used in phishing attacks. It specifically looks for HTTP requests where the host header contains variations of popular brand names like 'microsoft', 'google', 'paypal', 'amazon', and 'linkedin' with common typos (e.g., 'micros0ft', 'g00gle', 'paypa1', 'arnazon', 'linkedln'). The rule triggers on established HTTP connections to the server.
This rule detects HTTP traffic where the HTTP referer header indicates a social media platform (LinkedIn, Twitter, Facebook, Instagram) and the HTTP URI contains the string 'login'. This combination suggests a potential social media phishing attempt, where a user is redirected from a legitimate social media site to a credential harvesting page.
This rule detects potential scraping activity targeting LinkedIn job listings. It triggers an alert when a single source IP makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/jobs/' within a 60-second window. This behavior could indicate an automated script or tool attempting to collect job information for various purposes, including competitive intelligence, data aggregation, or reconnaissance.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
This rule detects repeated access attempts to web pages containing 'annual-report' in the URI. It triggers an alert if a single source IP makes 5 such requests within a 30-second window. This could indicate reconnaissance activity by an attacker looking for publicly available financial information.
This rule detects automated collection of organizational profile information characterized by a high rate of HTTP GET requests originating from specific user agents commonly associated with web scraping tools. It triggers an alert if a source IP makes 30 or more HTTP GET requests within a 20-second window, using user agents like 'python-requests', 'scrapy', 'curl', 'wget', or 'Go-http-client'. This behavior is indicative of reconnaissance activities, potentially for data exfiltration or vulnerability scanning.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
Wfuzz Directory Scanner Detected
Suricata
This rule detects the use of Wfuzz, a web fuzzer, by identifying the 'Wfuzz' string in the HTTP User-Agent header. This activity is typically associated with reconnaissance, as attackers use such tools to discover directories, files, and other web application structures.
Page 186 of 211