Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Page 271 of 756