Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the creation of remote scheduled tasks over SMB by looking for the string "schtasks" in TCP traffic destined for port 445 (SMB). This activity is often associated with persistence techniques where attackers establish scheduled tasks on remote systems.
This rule detects attempts to modify user accounts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) containing the hexadecimal representation of '0' (likely part of an LDAP message structure) and the case-insensitive string 'modify'. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating potential malicious activity related to account manipulation.
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
This rule detects network service scanning activity by identifying a high volume of TCP SYN packets (flags:S) from a single source IP address to multiple destinations within the HOME_NET over a short period. Specifically, it triggers if 50 or more SYN packets are observed from the same source within 10 seconds. This behavior is indicative of an attacker attempting to discover open ports and services on internal network hosts, a common reconnaissance technique.
This rule detects a potential SSH password brute force attack. It triggers an alert if there are 30 or more TCP connections to port 22 (SSH) on the home network from a single source IP address within a 60-second window. The 'flow:to_server' and 'flags:S' indicate that it's looking for new connection attempts (SYN packets) directed towards the server.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9150. This port is commonly used by Tor Browser for its SOCKS proxy, indicating potential use of Tor for anonymization or to bypass network restrictions. The rule specifically looks for the SYN flag in the TCP handshake, signifying the initiation of a connection.
Page 191 of 211