Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,182 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the creation of files named '.git-checker' within common temporary directories. This behavior is often associated with staging or persistence mechanisms used by malware or malicious scripts to track execution or environment status.
Detects the creation of files named '.git-checker' within common temporary directories. This behavior is often associated with staging or persistence mechanisms used by malware or malicious scripts to track execution or environment status.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Page 283 of 756