Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects a specific self-deletion technique used by the GRAYRABBIT loader, which utilizes NTFS Alternate Data Streams (ADS). The malware uses SetFileInformationByHandle with FileRenameInfo to rename the file to an ADS (colon-delimited), followed by FileDispositionInfo to mark the file for deletion upon handle closure, effectively bypassing standard file deletion alerts. This rule is scoped to processes originating from common user-writable or temporary directories while excluding known legitimate software installers.
This rule detects the creation of a .groovy file within a plugin directory related to JFrog Artifactory, followed by the execution of suspicious child processes (e.g., shell, curl, wget) by the Artifactory process within a short timeframe. This behavior is indicative of an attacker attempting to achieve remote code execution by deploying a malicious plugin.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
No description available.
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Page 491 of 756