Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,316 copies51 likes25,735 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.
Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.
Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Point-in-time sweep of the 16 published BraZetsu sample SHA-256 hashes across file, process and image-load telemetry. Hashes rotated across five versions, so absence of a hit does not rule out BraZetsu.
Point-in-time sweep of the 16 published BraZetsu sample SHA-256 hashes across file, process and image-load telemetry. Hashes rotated across five versions, so absence of a hit does not rule out BraZetsu.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Page 19 of 755