Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,183 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects potential Qilin ransomware binaries following Cisco FMC-based intrusion by UAT-11988. Source intel provides only name-level attribution (no sample hash/byte IOC for the payload), so this is tightened to a valid PE, a plausible ransomware-payload size band, and >=2 occurrences of the family string -- a bare single 'Qilin' substring in an arbitrary PE (e.g. an unrelated app, build path, or AV/report string) is not sufficient to alert on alone.
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Page 468 of 756