Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,376 copies51 likes26,098 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects high-frequency, automated web scraping behavior targeting product catalog pages, indicative of content harvesting for site replication. The rule monitors IIS logs for non-browser user agents (e.g., Python, curl, Scrapy) performing rapid, multi-page requests within a short duration.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects unreviewed commits to .gitlab-ci.yml that alter how the gitlab-triage tool invokes the sensitive API_TOKEN variable, with no associated merge request.
Page 565 of 756