Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to manipulate application runtime memory via web shell activity. Specifically, it looks for HTTP requests where the URI content contains the string "WriteProcessMemory" (case-insensitive). This string is indicative of an attempt to use a function commonly associated with injecting code or modifying the memory of a running process, often a technique employed by web shells to achieve persistence or execute arbitrary code.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
This rule detects potential command and control (C2) activity where commands are being read from a removable media share over SMB. It specifically looks for SMB traffic containing the string "USBSTOR" (case-insensitive) and ".txt" (case-insensitive), indicating access to text files on a USB storage device. A threshold of 5 occurrences within 30 seconds from the same source IP is applied to reduce false positives.
This rule detects the use of an external proxy service to mask Command and Control (C2) origin. It specifically looks for HTTP traffic where the 'X-Forwarded-For' header is present and the HTTP method is 'CONNECT'. A threshold of 10 occurrences within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects the use of an internal proxy server to route C2 (Command and Control) traffic. Specifically, it looks for HTTP CONNECT requests within the internal network ($HOME_NET to $HOME_NET) that are established and occur at a high frequency (10 times in 60 seconds from the same source). This pattern is indicative of a system inside the network attempting to tunnel C2 communications through an internal proxy.
This rule detects a potential FTP C2 (Command and Control) channel exhibiting a regular beaconing pattern. It triggers an alert if 10 or more TCP connections are made to port 21 (FTP) from a single source IP address within a 300-second window, indicating established communication from the internal network to an external FTP server. This behavior is characteristic of malware using FTP for C2 communications.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.
This rule detects attempts to discover the current user via a web shell by looking for HTTP requests containing the string "whoami" in the URI. This is a common command executed on compromised web servers to gain information about the user context of the web server process.
This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.
Page 194 of 211