Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
Detects NTFS ADS used to hide malicious payloads from standard directory listings
Detects deployment of macOS startup item plist files for persistence
Detects AppInit_DLLs registry modification for persistent DLL injection
Detects oversized DNS queries indicative of DNS tunneling for covert communications
Detects connections to default C2 ports used by Metasploit and common RAT frameworks
Detects access to paid threat intelligence or dark web data platforms
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
Detects data exfiltration occurring over non-standard alternate network mediums
Detects deployment of privileged Docker containers that may allow container escape
Page 53 of 211