Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
This rule monitors for HTTP header folding, a legacy evasion technique where header fields are split across multiple lines by using whitespace characters (tabs or spaces). This technique may be used by adversaries to bypass security controls such as web application firewalls or load balancers by smuggling malicious payloads or obfuscating traffic.
Detects repeated HTTP request field length anomalies which may indicate attempts to exploit buffer overflows, memory corruption vulnerabilities, or parser abuse against web services.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
KQL Query- List of known malicious IPs associated with Iranian-affiliated APT exploiting PLCs
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects network traffic to the command and control (C2) domain 'sfrclak.com', which is associated with compromised versions of the Axios npm package (specifically 1.14.1 and 0.30.4). This traffic represents the first stage of activity where dropper scripts on an affected endpoint attempt to communicate with their C2 server.
Page 6 of 8