Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,327 copies51 likes25,810 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects phishing messages that deliberately mix writing systems/scripts or use homoglyphs in the Subject line as ONE corroborating signal within a broader, multi-signal phishing pattern. This is the only translation that implements true sender-novelty checking via baseline lookups (a sending domain must be new to both the specific recipient and the organization as a whole to add risk). A weighted score (script-mixing=2, homoglyph=3, phishing vocabulary=2, sender-novelty=1, threshold=6) requires multiple corroborating signals before firing. Note: unlike the SPL/S1QL/CQL/CortexQL translations, this version does not strip brand/product tokens before the script check.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects a sequence of events where a user clicks a shared link to an AI chatbot conversation followed closely (within 15 minutes) by the execution of potentially malicious processes (mshta, powershell, cmd) that include suspicious command-line patterns indicative of ClickFix-style social engineering.
Detects anomalous device-authorization-grant (RFC 8628) activity indicative of device-code phishing attacks (e.g., Tycoon2FA). The rule identifies user accounts exhibiting a rapid succession of 'authorization_pending' (70016) status polling attempts followed by a successful token issuance (0), constrained to a short time window and excluding known first-party Microsoft CLI/dev-tool applications.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
Page 57 of 755