Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,184 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
This rule detects potential lateral movement by identifying suspicious child processes (such as cmd, powershell, or rundll32) spawned by WmiPrvSE.exe shortly after a remote interactive or network logon on the same device.
This rule detects potential lateral movement by identifying suspicious child processes (such as cmd, powershell, or rundll32) spawned by WmiPrvSE.exe shortly after a remote interactive or network logon on the same device.
Detects suspicious PowerShell execution initiated by explorer.exe containing encoded commands, correlated with concurrent activity in the Windows RunMRU registry key or execution of rundll32.exe referencing 'WindowsUpdate.log'. This pattern is frequently used to mask malicious activity and maintain stealth during fileless execution or persistence operations.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
This rule identifies installations of Parallels Desktop on Intel-based macOS devices that are within the 26.x version branch and have not been updated to the 27.0.0 fix. It utilizes software inventory and device information to alert on systems running vulnerable software susceptible to exploitation.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
Page 448 of 756