Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,130 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Page 210 of 756