Chaitanya B B
@mralienCompletionist
10 followers825 downloads137 copies97 likes2,061 views
28 detections
Filters
Last updated
All Time
Detection languages
19
9
Categories
9
3
3
2
2
Platforms
12
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
13
13
10
7
7
Detects when a WebKit-based browser process on macOS spawns a shell or script interpreter. This is highly suspicious and can indicate successful exploitation of a browser vulnerability for initial code execution.
Detects common PowerShell download cradles used to download and execute payloads from a remote source, a technique frequently used by threat actors like EncryptHub for initial access after a successful social engineering attempt.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
Detects AsyncRAT variants and their forks (DcRat, VenomRAT, etc.) based on process behavior, known IOCs, and security tool evasion techniques.
Detects suspicious activity related to Storm-2603 ransomware operations, including ToolShell exploitation, DLL sideloading, BYOVD AV-killers, and multi-ransomware deployment (LockBit, Warlock).
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
Detects indicators and behaviors related to the Chaos ransomware group including command-line patterns, suspicious registry changes, and specific known IOCs.
Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
Detects exploitation attempts of the SharePoint ToolShell 0-day (CVE-2025-53770) using known IOCs and behavior patterns
Page 1 of 3