Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,389 copies51 likes26,189 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects file hash hits matching known malicious IOCs or network connections to suspicious domains/URLs.
Detects file hash hits matching known malicious IOCs or network connections to suspicious domains/URLs.
Detects file hash hits matching known malicious IOCs or network connections to suspicious domains/URLs.
Page 391 of 756