Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
This rule detects a direct ICMP Flood Denial of Service (DoS) attack. It triggers when more than 500 ICMP echo request (type 8) packets are sent to a single destination within a 5-second interval. This high volume of ICMP traffic is characteristic of an attempt to overwhelm a target system or network with ping requests, leading to service disruption.
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
This rule detects attempts to modify the end-of-file marker on a network share, specifically looking for the 'SetEndOfFile' operation over SMB. This activity can be indicative of an attacker manipulating file sizes or content on shared resources, potentially as part of data staging or to evade detection. The rule is configured with a threshold to alert on 20 such events from the same source within 30 seconds, aiming to reduce noise from legitimate, infrequent operations.
This rule detects potential command and control (C2) communication over the MQTT protocol. It specifically looks for TCP traffic on port 1883 (the standard MQTT port) from the home network to any destination. The detection is triggered by the presence of a specific byte sequence ('|10|') at the beginning of the payload, which corresponds to an MQTT PUBLISH message type. A threshold of 5 such messages within 60 seconds from the same source IP is set to reduce false positives, indicating a sustained pattern of MQTT PUBLISH activity that could be indicative of C2.
This rule detects an active remote session hijack attempt. It triggers when three or more TCP connections are established to the same destination within a 10-second window, originating from the internal network and destined for the internal network. This pattern could indicate an attempt to take over an existing network session.
This rule detects attempts to establish a VNC (Virtual Network Computing) connection on TCP port 5901, which is an alternative port often used for VNC. The detection is based on the presence of the 'RFB 00' string, which is part of the VNC protocol handshake, within the initial bytes of an established TCP connection flowing to the server.
This rule detects attempts to establish a VNC (Virtual Network Computing) remote desktop session to a host on the protected network. It specifically looks for TCP traffic destined for port 5900 (the default VNC port) and the presence of the 'RFB 00' string within the initial bytes of the connection, which is characteristic of the VNC RFB (Remote Framebuffer) protocol handshake.
This rule detects Kerberos Domain Trust Discovery attempts by monitoring for a high volume of Kerberos Ticket Granting Ticket (TGT) requests to port 88 (Kerberos) on the home network. A threshold of 20 requests from a single source IP within 10 seconds triggers the alert, indicating a potential network scan activity aimed at mapping domain trusts.
This rule detects attempts to inject OLE (Object Linking and Embedding) objects into web requests, specifically looking for the keywords 'CLSID' and 'ProgID' within the HTTP client body. This technique can be used for inter-process communication and potentially lead to arbitrary code execution or other forms of attack.
Page 61 of 211