Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,750 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects deletion of persistence registry keys after successful execution
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
Detects APC injection technique using QueueUserAPC for code execution
Detects PsExec used for remote command execution in lateral movement
Detects LSASS process memory access for credential dumping
Detects use of export-grade cipher suites to reduce key strength
Detects SSPI hooking used to intercept authentication credentials
Detects Rundll32 used to execute arbitrary DLL code
Detects modification of Winlogon registry keys for DLL persistence
Detects use of Google search operators for target site reconnaissance
Page 6 of 211