Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.
This rule detects the delivery of a malicious LNK file via HTTP that utilizes icon smuggling. It specifically looks for HTTP responses containing a URI with ".lnk" and the byte sequence "|4C 00 00 00|" at the beginning of the file data, which is characteristic of LNK files. Icon smuggling is a defense evasion technique where a malicious file disguises itself with a legitimate icon to trick users into executing it.
This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
This rule detects HTTP traffic where the URI contains both "pcalua" and "-a" (case-insensitive). This pattern is indicative of indirect execution via pcalua.exe, a legitimate Windows utility that can be abused by attackers to proxy execution of other programs, often for defense evasion. The rule specifically looks for this behavior in HTTP requests, suggesting an attempt to download or execute a payload indirectly.
Page 62 of 211