Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,376 copies51 likes26,099 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects unauthenticated GET requests to GitLab CI/CD job artifact download endpoints on a public repository, which can expose leaked secrets bundled into build artifacts.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.
This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.
Page 566 of 756