Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects CMSTP used with INF files for UAC bypass and code execution
Detects execution of Electron application ASAR packages for code execution
Detects enumeration of Docker containers and images
Detects cloud resources created in rarely used geographic regions for evasion
This rule detects the delivery of a malicious XSL (Extensible Stylesheet Language) script via HTTP to a client. The detection is based on the HTTP URI containing ".xsl" (case-insensitive) and the file data containing "<msxsl:script" (case-insensitive). This pattern is indicative of an attempt to use XSLT for proxy execution, often associated with techniques like WMIC (Windows Management Instrumentation Command-line) for defense evasion.
This rule detects the use of a SOCKS proxy as an external Command and Control (C2) relay. Specifically, it looks for TCP traffic on port 1080 (a common SOCKS proxy port) from the home network to any destination, and checks for the SOCKS version 5 handshake initiation sequence (05 01 00) at the beginning of the payload. This pattern indicates a client attempting to establish a SOCKSv5 connection, which can be used by malware for C2 communication to evade detection and bypass network restrictions.
This rule detects HTTP traffic where the 'Host' header contains common Content Delivery Network (CDN) domains (cloudfront.net, azureedge.net, fastly.net, cloudflare.net) and the 'X-Forwarded-Host' header is also present. This pattern can indicate C2 infrastructure attempting to hide behind CDN fronting, a technique used by adversaries to obscure the true origin of their command and control servers.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.
Page 50 of 211