Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,383 copies51 likes26,109 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects instances where a process named MsCache.exe deletes files within the Google Chrome User Data directory. This pattern may indicate unauthorized activity by a process masquerading as a cache-related utility to modify or delete browser-related artifacts.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Page 561 of 756