Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
This rule detects the delivery of a payload containing the strings "SpAcceptCredentials" and "hook" within HTTP response body data. This pattern is indicative of an SSPI credential hooking attempt, where an attacker tries to intercept or steal credentials by injecting malicious code into the Security Support Provider Interface (SSPI) process. The detection is focused on traffic flowing from the server to the client.
This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the string 'keys' (case-insensitive) and the data size is greater than 200 bytes. This combination suggests that a keylogger might be sending captured keystrokes or other sensitive data to a remote server.
This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.
This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.
Page 198 of 211