Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,383 copies51 likes26,115 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects attempts to modify, disable, or exclude paths and processes from Microsoft Defender Antivirus using legitimate administrative utilities such as PowerShell, cmd, sc, and netsh. This behavior is indicative of an adversary attempting to evade security monitoring.
Detects suspicious activities originating from CrowdStrike Falcon remediation processes (e.g., CSFalconService.exe, CSFalconContainer.exe). The rule identifies two distinct patterns: either a file operation (delete, modify, rename, quarantine, or restore) followed within 2 minutes by the loading of an unsigned or non-standard DLL, or the spawning of an elevated SYSTEM process from a non-SYSTEM parent process. This behavior is indicative of potential LPE (Local Privilege Escalation) abuse via the Falcon remediation engine, often referred to as FalconFlank-style exploitation.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
This rule detects OAuth authorization requests (targeting Microsoft or Google identity providers) that use 'prompt=none' (silent authentication) and redirect the user to an unexpected or untrusted domain. This pattern is commonly used in OAuth consent phishing or token theft attacks, where an attacker attempts to silently acquire an authorization code by redirecting it to a malicious application server instead of the legitimate service provider's domain.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
Detects suspicious activities originating from CrowdStrike Falcon remediation processes (e.g., CSFalconService.exe, CSFalconContainer.exe). The rule identifies two distinct patterns: either a file operation (delete, modify, rename, quarantine, or restore) followed within 2 minutes by the loading of an unsigned or non-standard DLL, or the spawning of an elevated SYSTEM process from a non-SYSTEM parent process. This behavior is indicative of potential LPE (Local Privilege Escalation) abuse via the Falcon remediation engine, often referred to as FalconFlank-style exploitation.
This rule detects unauthorized attempts to modify CrowdStrike Falcon sensor exclusion registry keys or commands involving DLL loading techniques that may indicate evasion preparation, specifically referencing potential FalconFlank-related activities. It filters out legitimate management activity from known service accounts, SCCM, and the CrowdStrike Falcon agent itself.
Page 559 of 756