Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,185 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects StealC-related .NET payload protected with ConfuserEx, requiring the sample-specific mutex string, AES key material, and multiple anti-debugging indicators together to avoid matching benign ConfuserEx-obfuscated applications
This rule detects instances where a process associated with a known StealC command-and-control (C2) IP address subsequently spawns a hidden cmd.exe instance. It correlates network connections to known malicious infrastructure with the creation of hidden command shells within the same device session, specifically looking for common parent processes like web browsers or system utilities.
This rule detects instances where a process associated with a known StealC command-and-control (C2) IP address subsequently spawns a hidden cmd.exe instance. It correlates network connections to known malicious infrastructure with the creation of hidden command shells within the same device session, specifically looking for common parent processes like web browsers or system utilities.
Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.
Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.
Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.
Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
Page 340 of 756