Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects when a file is written to a remote Windows Startup folder via Server Message Block (SMB). The rule specifically looks for SMB traffic containing the string "Startup" and "\AppData\Roaming\Microsoft\Windows\" (case-insensitive) in the flow to the server. This activity is often associated with persistence mechanisms where malware or an attacker attempts to execute code automatically upon system startup.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.
Page 187 of 211