Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,184 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
This rule detects high-volume, burst-pattern email distribution associated with a 'New VM Received' subject line, originating from non-authorized or non-corporate domains. This behavior is indicative of potential mass phishing or spam campaigns mimicking automated voicemail notifications.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
GhostContainer
YARA
Detects GhostContainer .NET-based backdoor assembly components deployed on compromised Exchange servers, requiring multiple corroborating unique indicators (module/class names, C2 header, masquerading filenames) to reduce false positives on generic .NET assemblies
Page 457 of 756