Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,162 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
Detects anomalous post-exploitation behavior associated with SectopRAT, where a suspicious process (e.g., ReportDump.exe) establishes a persistent network connection to a known C2 IP address followed closely by the invocation of common command-line utilities (cmd, powershell, tasklist, etc.) used for file and process management.
Detects anomalous post-exploitation behavior associated with SectopRAT, where a suspicious process (e.g., ReportDump.exe) establishes a persistent network connection to a known C2 IP address followed closely by the invocation of common command-line utilities (cmd, powershell, tasklist, etc.) used for file and process management.
Page 223 of 756