Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,388 copies51 likes26,186 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
Detects HEAVYGRAM/CRUDEEXCLUDE persistence via Run-key registry writes or reg.exe command-line adds, scoped to payloads staged in AppData/ProgramData/Temp/Public/Downloads and excluding legitimate Program Files/System32 targets to reduce false positives from normal software autorun entries.
Page 404 of 756