Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects the use of PowerShell to modify Microsoft Defender settings to disable real-time, behavior, and IOAV protection, while simultaneously adding a full-drive exclusion for the root directory (C:\). This behavior is characteristic of an adversary attempting to disable security monitoring to facilitate further malicious activity or avoid detection.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects potential remote command execution using Windows Management Instrumentation (WMI) via wmic.exe or PowerShell, as well as suspicious child processes spawned by the WMI provider host (wmiprvse.exe). It monitors for command lines utilizing the /node switch to target remote systems or invoking WMI methods to trigger execution, which are common patterns for lateral movement.
Detects high-value wire transfers (>= €600,000) directed to beneficiaries in Hong Kong that contain suspicious memo or description fields related to confidential acquisitions or professional service retainers, potentially indicating business email compromise (BEC) or fraudulent financial activity.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Page 490 of 756