Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,387 copies51 likes26,185 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
Detects shell/install scripts that deploy an XMRig-based Monero cryptominer, consistent with the install script planted on the LeakySensey git repository server
Detects shell/install scripts that deploy an XMRig-based Monero cryptominer, consistent with the install script planted on the LeakySensey git repository server
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
Page 424 of 756