Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.
This rule detects potential account takeover attempts by identifying the replay of stolen session cookies. It specifically looks for HTTP traffic from the home network to any destination, where the HTTP cookie header contains the case-insensitive string "session". A threshold of 5 occurrences within 3 seconds, tracked by destination, is used to trigger an alert, indicating a rapid succession of session cookie replays.
Detects unauthorized access to Windows Credential Manager vault
Detects NOP sled patterns in payloads indicating junk code insertion for evasion
Detects malicious logon scripts deployed to the NETLOGON share for domain-wide execution
Page 63 of 211