Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects hidden iframes used for drive-by download attacks
Detects unauthorized domain controller replication that may indicate DCSync or rogue DC
Detects disabling of AWS CloudTrail audit logging
Detects probing of firewall and VPN management interfaces for security appliance discovery
Detects cross-site scripting attempts in HTTP requests
Detects MSBuild used with inline task to execute arbitrary code
Detects use of macOS resource forks to hide malicious data
Detects upload of backdoored container images to internal registries
Detects bulk downloading of SharePoint document libraries
This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.
Page 46 of 211