Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to enumerate Docker containers via the Docker API. Specifically, it looks for HTTP requests to the '/containers/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity is indicative of an adversary trying to discover running containers on a compromised host.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
XOR Encoded C2 Traffic Pattern
Suricata
This rule detects HTTP client body traffic that appears to be XOR encoded, characterized by a long sequence of non-printable ASCII characters (bytes 0x01-0x1f and 0x7f-0xff) of at least 50 characters. This pattern is often indicative of Command and Control (C2) communication used by malware to evade detection.
Bitsadmin Tool Transfer Download
Suricata
This rule detects the use of the 'bitsadmin' tool in HTTP user agent strings during a file transfer download. Bitsadmin is a legitimate Windows command-line tool used to create, manage, and monitor download and upload jobs, but it is frequently abused by adversaries for command and control, data transfer, and persistence.
This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.
This rule detects an SSH brute force attack by monitoring TCP connections to port 22 (SSH) on the home network. It triggers an alert if more than 20 TCP SYN packets are observed from a single source IP address within a 60-second window, indicating a high volume of connection attempts characteristic of a brute force.
This rule detects attempts at path traversal vulnerabilities by looking for the string "../../../" in HTTP URIs. This pattern is commonly used by attackers to navigate directory structures outside of the intended web root.
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.
This rule detects unauthenticated access attempts to the Docker Daemon API, specifically targeting TCP port 2375. It triggers on the initial SYN packet of a TCP connection to this port, indicating an attempt to establish a connection to the Docker API without authentication. This activity is often associated with privilege escalation attempts, as an unauthenticated Docker API can be exploited to gain control over the host system.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
Page 190 of 211