Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,385 copies51 likes26,176 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects network activity communicating with Google Drive domains (drive.google.com and www.googleapis.com). This rule monitors outbound traffic, which may indicate the use of Google Drive as a command-and-control (C2) channel or for unauthorized data exfiltration.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects potential remote command execution using Windows Management Instrumentation (WMI) via wmic.exe or PowerShell, as well as suspicious child processes spawned by the WMI provider host (wmiprvse.exe). It monitors for command lines utilizing the /node switch to target remote systems or invoking WMI methods to trigger execution, which are common patterns for lateral movement.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Page 508 of 756