Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,368 copies51 likes26,043 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects automated reconnaissance and enumeration of sensitive web application paths (admin, config, environment files, etc.) from a single source IP. The rule identifies high-frequency request patterns that target specific non-public surface areas while excluding known search engine crawlers and monitoring bots.
Page 597 of 756