Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects modification of AWS organizational units to evade policy controls
Detects cloud instance creation in unusual regions for evasion
Detects creation of malicious container services via Docker API for persistence
Detects creation of macOS Launch Agent plist files for persistence
Detects creation of inbox rules to hide attacker communications from victim
Detects PowerShell running base64 encoded commands
Detects Linux ptrace system call abuse for process injection
Detects downloads of executable scripts directly from raw GitHub URLs
Detects modification of power settings to keep system awake for malware
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
Page 52 of 211