Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,182 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects potential credential harvesting or process memory manipulation against browser processes (Chrome or Edge). The rule monitors for unauthorized debugging activity initiated against browser processes (e.g., using flags like DEBUG_PROCESS or specific API calls) and the access of the App-Bound encryption provider symbol, which is often a target for attackers seeking to decrypt browser-stored secrets.
Detects periodic screen capture activity performed by Node.js or Electron-based processes, correlated with subsequent outbound network connections to public IP addresses within a short timeframe. This behavior is indicative of the JSCeal malware's surveillance and exfiltration module, where local reconnaissance via screenshotting is followed by data transmission.
Detects a suspicious sequence of activities where PowerShell downloads or extracts specific zip files (node.zip, build.zip) to staging directories, followed by the execution of associated binaries like node.exe, winpty-agent.exe, or winpty.dll from those same locations. This behavior is indicative of an adversary staging and executing tooling within temporary user directories.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects administrative changes (create, update, delete) to Cloudflare DNS records, load balancer pools, or origin pools specifically associated with 'registry.coder.com', as well as anomalous login and API token activity on the Cloudflare account. Such activity may indicate unauthorized configuration tampering, potential account compromise, or malicious modifications to critical infrastructure endpoints.
Detects the execution of Terraform commands (init, apply, plan) that interact with the 'registry.coder.com' domain, or direct network connections to the associated infrastructure. This may indicate the use of unauthorized or compromised Infrastructure-as-Code (IaC) modules or malicious supply chain activity involving Terraform configurations.
Detects the creation of tar archives within the Coder database during a specific window associated with rogue IP activity, where the file creation was performed by a system-level process.
Detects PEEP Secure Preferences integrity-hash forgery (protection.macs/super_mac) and known PEEP persistence scripts (patch_secure_prefs.ps1, install_silent.ps1, force_enable.ps1), anchored to actual Chrome/Edge profile paths rather than generic terms like 'protection' or 'developer_mode' that appear in unrelated admin tooling.
Page 488 of 756