Ali AlEnezi
@siteCompletionist
2 followers45 downloads264 copies6 likes5,288 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
Detects inbound HTTP traffic directed to internal hosts on ports other than commonly used web ports (80, 443, 8080, 8443, 8000, 8888, 3128). This behavior may indicate an attempt to bypass network security controls or the use of non-standard ports for command and control or data exfiltration.
This rule identifies critical or high-severity software vulnerabilities affecting devices tagged as part of a PCI-CDE (Payment Card Industry Cardholder Data Environment) scope. It summarizes the findings by CVE, severity level, count of affected devices, and specific assets involved, prioritizing remediation for PCI compliance.
This rule detects outbound TLS connections from the internal network to external destinations where the server certificate is self-signed. It identifies connections where both the certificate issuer and subject common names (CN) are present, which is often indicative of opportunistic encryption used by C2 infrastructure or malicious payloads. The rule includes a threshold to reduce noise by limiting alerts for the same source over a specific window.
Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.
This rule detects potentially malicious OAuth application consent grants in Microsoft Entra ID (formerly Azure AD). It monitors for consent events involving high-risk scopes by non-verified publishers, instances of admins attempting to bypass consent requirements, and follows up by checking for unusually high activity (sign-ins or resource access) from the newly consented application within a short timeframe.
Detects the creation or modification of Power Automate flows that involve potentially sensitive external services or personal email providers, which may indicate data exfiltration or unauthorized integration setup.
This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Page 4 of 8