Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects access to Azure portal for cloud service dashboard discovery
Detects attempts to escalate privileges via sudo
Detects Telnet access to network devices for infrastructure compromise
Detects network service scanning for target discovery
This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.
This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.
Detects registration of malicious authentication packages for credential capture
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
Detects process hollowing technique for code injection
Detects C2 traffic using non-standard ports to evade detection
Page 27 of 211