Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,182 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Detects the creation of files named '.git-checker' within common temporary directories. This behavior is often associated with staging or persistence mechanisms used by malware or malicious scripts to track execution or environment status.
Page 282 of 756