Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,389 copies51 likes26,189 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the creation of Windows services immediately following a network logon event (Logon Type 3) using NTLM or Kerberos. The rule monitors for service names or file paths characteristic of PsExec-style remote execution tools, specifically focusing on suspicious paths (e.g., Temp, UNC paths) or file extensions (e.g., .bat, .ps1, .tmp) used by attackers to execute payloads laterally.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
This rule detects modifications to Windows Registry persistence keys (Run and RunOnce) associated with specific suspicious filenames ('cplsupport.exe', 'wtass.exe'), as well as modifications to specific Synapse agent configuration registry keys. These patterns are often associated with persistence mechanisms or unauthorized software configuration changes.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.
This rule detects the installation of Windows services that utilize names or display names commonly associated with known malware, potentially mimicking legitimate system services to maintain persistence or evade detection.
Page 387 of 756