Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,184 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Page 323 of 756