Ali AlEnezi
@siteCompletionist
2 followers45 downloads264 copies6 likes5,288 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
This rule detects TLS handshakes where the Server Name Indication (SNI) field contains an IP address literal instead of a domain name. Legitimate web services and applications typically use FQDNs for TLS SNI to support virtual hosting. Using an IP literal in the SNI field is a technique often used by malware, C2 infrastructure, and malicious scripts to establish encrypted connections while avoiding standard DNS lookups, which may be logged or monitored.
Detects anomalous activity by newly added guest users in Microsoft Teams, specifically identifying when a guest user account is added and subsequently performs multiple file-related operations (upload, download, access) or message-sending activities within a short timeframe. This behavior can be indicative of external threat actors or compromised guest accounts exfiltrating or accessing sensitive information within a Teams workspace.
This rule detects administrative changes to domain federation settings or domain authentication configurations within an Azure Active Directory (Microsoft Entra ID) environment. These modifications can be used to establish persistence or facilitate identity-based attacks, such as domain-wide impersonation, by altering how identities are authenticated.
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
This rule detects common patterns associated with Expression Language (EL) injection attacks in HTTP traffic. These patterns typically attempt to invoke Java reflection, runtime execution, or process creation through vulnerable applications utilizing templating engines or expression evaluators (e.g., OGNL, Spring Expression Language). Attackers use these to achieve remote code execution (RCE).
Page 5 of 8