Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
This rule detects attempts to remove a network share connection using the 'NetUseDel' command. This activity is often associated with adversaries trying to hide their access or clean up traces after establishing persistence or performing other actions on a compromised system. The detection specifically looks for the 'NetUseDel' string within TCP traffic directed to port 445 (SMB/CIFS), indicating an attempt to delete a network share.
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
This rule detects HTTP responses that contain a Windows executable (indicated by 'MZ' header) and where the HTTP URI path contains specific Windows utility names (mshta, rundll32, regsvr32, msiexec, installutil, cmstp). This combination suggests a potential attempt to use signed binaries as proxies for malicious execution, a common defense evasion technique.
Page 196 of 211