Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects brute force or credential stuffing against social media accounts
Detects SQL injection patterns in HTTP requests
Detects fake Windows authentication prompts used to capture credentials
Detects creation of disposable email accounts used for attack infrastructure
Detects Cobalt Strike beacon default HTTP checkin pattern
Detects DCSync replication attack for credential dumping from AD
Detects malware using Pastebin as a dead drop resolver for C2 config
Detects files using double extensions to disguise executable payloads
Detects bulk export of Confluence wiki content
Page 31 of 211