Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This rule detects the download of a file that appears to be an Office document template designed for remote template injection. It specifically looks for HTTP responses containing the strings "[Content_Types].xml" and "attachedTemplate" (case-insensitive) within the file data, which are indicators of a malicious Office document attempting to load a remote template.
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
This rule detects attempts to access directory listings on a web server via HTTP. It specifically looks for HTTP responses containing the string "Index of /" in the file data, which is a common indicator of an exposed directory listing. This exposure can allow attackers to discover sensitive files and directories on the server.
Page 188 of 211