Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
SSH Brute Force Attempt Detected
Suricata
Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.
This rule detects attempts to create a new local user account on a system via a remote Server Message Block (SMB) connection. It specifically looks for the string "NetUserAdd" (case-insensitive) within TCP traffic destined for port 445, which is commonly used by SMB. This activity is indicative of an attacker attempting to establish persistence or gain further access by creating new accounts.
This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.
Page 199 of 211