Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,183 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound network connections from devices to specific suspicious domains identified in the detection logic. This rule monitors for connections to 'ns2.asiainfo.it.com' and 'www.wordcheck.info', which may be indicative of malware communication, command and control, or malicious web activity.
This rule detects network connections from internal devices to known SpiceRAT Command and Control (C2) infrastructure IPs. The detection filters for successful connections on common ports (80, 443) that meet a volume threshold, indicating potential ongoing beaconing or communication with malicious infrastructure.
This rule detects network connections from internal devices to known SpiceRAT Command and Control (C2) infrastructure IPs. The detection filters for successful connections on common ports (80, 443) that meet a volume threshold, indicating potential ongoing beaconing or communication with malicious infrastructure.
Comprehensive IOC sweep across endpoint file/process/network telemetry for the full set of known SilkParasite/SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy infrastructure indicators reported by Hunt.io and Security Affairs: all listed C2/decoy/certificate-hosting IPs, all listed spoofed/infrastructure domains, and known file/certificate hashes (SHA256, SHA1).
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Page 290 of 756