Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,385 copies51 likes26,175 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Page 506 of 756