Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP responses containing a payload that appears to be XOR encrypted. It specifically looks for a sequence of at least 200 bytes consisting of non-printable ASCII characters (0x01-0x1f and 0x7f-0xff) within the file data of an HTTP response flowing to the client. This pattern is indicative of XOR encryption, often used by malware to obfuscate its payload.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.
This rule detects the negotiation of an export-grade cipher suite during a TCP connection to port 443 (HTTPS). Specifically, it looks for the byte sequence '|00 1B|' at a depth of 2 bytes within the TCP payload, which corresponds to a specific cipher suite identifier often associated with weaker, export-grade cryptography. This could indicate an attempt to downgrade encryption for easier interception or exploitation.
This rule detects the use of the 'chattr +i' command over a network connection to port 22 (SSH). The 'chattr +i' command on Linux is used to make a file immutable, meaning it cannot be modified, deleted, or renamed, even by the root user. This behavior can be indicative of an attacker attempting to prevent forensic analysis or hinder system recovery by protecting their malicious files or modifying critical system files.
This rule detects attempts to copy the /etc/shadow file, which contains hashed user passwords, for offline password cracking. It specifically looks for the string "cat /etc/shadow" in TCP traffic destined for the home network on any port, indicating a potential exfiltration attempt or preparation for credential access. The rule is designed to alert on established connections where this specific command is observed.
This rule detects attempts to dump LSA secrets by accessing the 'SECURITY\Policy\Secrets' registry key remotely over SMB (port 445). This activity is indicative of credential access attempts, specifically targeting cached credentials or other sensitive information stored in the Local Security Authority (LSA). The rule looks for the specific string 'SECURITY\Policy\Secrets' within TCP traffic destined for port 445, suggesting an attempt to read this registry path.
This rule detects HTTP traffic containing the string "KerberosRequestorSecurityToken" in the file data, indicating a potential Kerberos exploit for credential theft delivery. The detection is focused on traffic flowing from the server to the client.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects the creation of a new service account key within Google Cloud Platform (GCP) via the 'iam.googleapis.com' API. Specifically, it looks for HTTP POST requests to URIs containing 'serviceAccounts' and 'keys'. This activity can be indicative of privilege escalation, where an attacker creates a new key for an existing service account to gain persistent access or elevate their privileges.
Page 51 of 211