Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,122 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects anomalous command-line arguments and process injection behaviors associated with the Sogou IME protocol handler (biz_helper.exe). The rule monitors for malicious argument injection (e.g., embedded scripts, URLs pointing to non-Sogou domains) and correlates these events with suspicious child processes or network activity, consistent with techniques observed in the GRAYRABBIT / UNC3569 threat activity.
Detects known malicious file hashes for GRAYRABBIT delivery chain components: trojanized 7zp.dll loader, encrypted PE loader shellcode, and GRAYRABBIT backdoor core.dll, gated on PE structural validity and filesize
Detects UNC3569/GRAYRABBIT shellcode combining call/pop self-location, PEB InLoadOrderModuleList walk, and the specific XOR-then-ROR8 export-name hashing loop observed in the GRAYRABBIT loader chain, requiring multiple distinctive elements together to reduce false positives on generic shellcode idioms
Detects UNC3569/GRAYRABBIT shellcode combining call/pop self-location, PEB InLoadOrderModuleList walk, and the specific XOR-then-ROR8 export-name hashing loop observed in the GRAYRABBIT loader chain, requiring multiple distinctive elements together to reduce false positives on generic shellcode idioms
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Page 554 of 756