Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,366 copies51 likes26,035 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects changes to Keycloak realm configurations that enable the 'Forgot password' (resetPasswordAllowed) setting. This specific configuration change is associated with temporary mitigation strategies for CVE-2026-18963 on known-vulnerable versions of Keycloak.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects malicious network connections, file downloads, or process execution associated with the REVSTEALER malware campaign, which utilizes hijacked YouTube channels to distribute fake game-cheat videos that lure users into downloading 'resightloader.exe' from specific malicious domains.
Detects instances where the NW.js (Node-Webkit) framework binaries (nw.exe, node.exe) spawn common command-line interpreters or script-hosting utilities (e.g., cmd.exe, powershell.exe, wscript.exe) while executing associated application files like main.js or nw.pak. This behavior is indicative of potential exploitation of a browser-based application to gain shell access or execute arbitrary code on the host system.
This rule detects exploitation attempts against CVE-2021-33045 in Dahua devices. It identifies network traffic where a 'global.login' RPC request uses the 'Loopback' login type with a spoofed source IP address of '127.0.0.1' within the request body, while the actual TCP source address of the packet originates from a remote/external location. This technique is used to bypass authentication mechanisms.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects command-line execution of tools (route, netsh, sysctl) intended to modify host routing tables or enable IP forwarding. Such activity on workstation endpoints may indicate an attempt to bridge network segments, bypass network security boundaries, or facilitate lateral movement/C2 communications.
Page 604 of 756