Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
This rule detects potential command and control (C2) communication where data is hidden within image files using steganography. It specifically looks for HTTP responses (flow:to_client) containing JPEG image headers ('FF D8 FF') within the first 3 bytes, with a file size greater than 500,000 bytes. A threshold is applied to trigger an alert if 5 such events occur from the same destination within 60 seconds, indicating a potential high volume of large steganographic image transfers.
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects HTTP traffic where the 'Host' header contains common Content Delivery Network (CDN) domains (cloudfront.net, azureedge.net, fastly.net, cloudflare.net) and the 'X-Forwarded-Host' header is also present. This pattern can indicate C2 infrastructure attempting to hide behind CDN fronting, a technique used by adversaries to obscure the true origin of their command and control servers.
This rule detects potential RDP session hijacking attempts originating from an internal host. It specifically looks for TCP traffic destined for port 3389 (RDP) on the home network, with a specific content signature "|03 00|" at the beginning of the payload. A threshold of 3 connections within 10 seconds from the same destination is set to reduce false positives.
This rule detects when a file with the '.docm' extension is written to a network share via SMB. The presence of '.docm' suggests a macro-enabled Office document, which is often used in malicious campaigns. The rule specifically looks for the content '.docm' and a backslash character ('\') within the SMB traffic, indicating a file path or content related to a document.
This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.
Detects processes ignoring termination signals to prevent shutdown
Page 55 of 211