Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,388 copies51 likes26,186 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
Detects the execution of known development, scripting, and administrative tools (e.g., Python, Node.js, GCC, Docker) from non-standard or unauthorized file paths. The rule leverages allowlists for process names, publishers, and trusted installation directories to identify potentially unauthorized usage of powerful tooling often abused by attackers for post-exploitation activities.
Detects the execution of known development, scripting, and administrative tools (e.g., Python, Node.js, GCC, Docker) from non-standard or unauthorized file paths. The rule leverages allowlists for process names, publishers, and trusted installation directories to identify potentially unauthorized usage of powerful tooling often abused by attackers for post-exploitation activities.
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects the creation of files named '.git-checker' within common temporary directories. This behavior is often associated with staging or persistence mechanisms used by malware or malicious scripts to track execution or environment status.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Page 400 of 756