Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,316 copies51 likes25,713 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Page 13 of 755