Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects delivery of process injection toolkit payloads via network
Detects modification of PAM configuration files allowing authentication bypass
Detects large data transfers to removable storage media for physical exfiltration
Detects delivery of malicious dylib files for macOS library hijacking
Detects download of potentially malicious browser extension CRX packages
Detects system language and locale queries used to validate attack targets
Detects VNC connections used for visual remote desktop lateral movement
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
This rule detects the presence of a Right-to-Left Override (RLO) character sequence in the content of an email sent over SMTP. The RLO character (U+202E, represented as E2 80 AE in UTF-8) is often used in phishing or malware campaigns to visually reverse the order of characters in a filename, making an executable file appear to be a benign file type (e.g., 'document.txt.exe' could appear as 'document.exe.txt'). The rule specifically looks for this byte sequence in traffic destined for port 25 (SMTP) and flags it as trojan activity.
Detects scraping of partner and vendor relationship pages for supply chain targeting
Page 48 of 211