Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,369 copies51 likes26,049 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
Page 171 of 756