Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,383 copies51 likes26,109 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects remote administration activity via Windows Management Instrumentation (WMI) originating from a host that has no recorded history of performing such actions within the previous 30 days. This includes the use of wmic.exe for remote nodes, Invoke-WmiMethod, or WmiPrvSe.exe spawning common command-line interpreters or utilities.
Detects network requests to unpkg.com or npmmirror for 'index.html' files directly under a package path. This behavior deviates from standard package management usage (which typically fetches tarballs or specific JavaScript modules) and is often associated with adversaries using npm packages as hosting infrastructure for phishing landing pages.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
Page 564 of 756