Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,183 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects instances where a Node.js process spawns a child Node.js process from a 'node_modules' directory using configuration flags typically associated with hidden, detached background tasks (e.g., 'detached', 'stdio', 'windowsHide', 'ignore'). It explicitly excludes common Node.js process managers and build tools to reduce false positives associated with legitimate development activities.
Detects successful device code authentication flows involving applications that are not part of a known list of standard Microsoft and Azure client applications. Device code flows are frequently abused in phishing attacks to bypass traditional credential-based authentication.
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects creation of the 'keyroll' scheduled task used to relaunch the Sauron Loader DLL side-loading chain. Requires the schtasks.exe command line to both reference the 'keyroll' task name AND explicitly reference the ProgramData\keyroll path or rnpkeys.exe (ruling out unrelated tasks that happen to be named 'keyroll', e.g. legitimate key-rotation automation), and requires an INNER join corroborating an actual rnpkeys.exe relaunch from that path within 24h — a lone task-creation event with no follow-on relaunch no longer alerts.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Page 287 of 756