Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,130 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
Detects the creation, modification, or renaming of PHP files within the 'wp-content/uploads' directory of a WordPress installation. This pattern is commonly indicative of an attacker uploading a web shell to maintain persistence or execute arbitrary code on a compromised web server.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
This rule detects the creation of a scheduled task using 'schtasks.exe' where the task name matches commonly abused names such as 'WinUpdate.exe', 'SoftManager.exe', or 'LockAppHost.exe'. These names are frequently used by adversaries to masquerade as legitimate Windows processes to achieve persistence.
Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.
Detects interactive root shell requests via 'sudo -i' that occur shortly after a failed Parallels appliance installation or tar extraction event containing specific error codes or configuration markers (UCP_UID=0). This pattern aligns with the exploitation chain for CVE-2026-90894, where an attacker leverages an extraction failure to escalate privileges.
Page 547 of 756