Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,388 copies51 likes26,186 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Page 408 of 756