Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9050, specifically looking for the SYN flag. Port 9050 is commonly associated with Tor SOCKS proxy services. This activity is classified as a policy violation and is linked to the MITRE ATT&CK technique T1090.003, which involves using a Tor proxy for defense evasion.
This rule detects a high volume of IMAP/SSL connections to port 993 from a single source IP address within a short timeframe, which could indicate an attempt to collect emails in bulk, potentially associated with MITRE ATT&CK technique T1114 (Email Collection). The threshold is set to 30 connections within 60 seconds from the same source.
This rule detects potential Global Catalog LDAP enumeration attempts. It triggers when a source IP makes 10 or more TCP connections to destination port 3268 (the default port for Global Catalog LDAP) within a 60-second window. This behavior can indicate an attacker attempting to discover information about users, groups, and computers within an Active Directory environment.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 5000 bytes, indicating a significant upload.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.
This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.
This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.
Page 192 of 211