Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,389 copies51 likes26,189 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Page 375 of 756