Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,360 copies51 likes26,027 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects a specific self-deletion technique used by the GRAYRABBIT loader, which utilizes NTFS Alternate Data Streams (ADS). The malware uses SetFileInformationByHandle with FileRenameInfo to rename the file to an ADS (colon-delimited), followed by FileDispositionInfo to mark the file for deletion upon handle closure, effectively bypassing standard file deletion alerts. This rule is scoped to processes originating from common user-writable or temporary directories while excluding known legitimate software installers.
Detects the suspicious execution of cmd.exe with piped stdio handles (indicative of a reverse shell) initiated by non-standard parent processes associated with the GRAYRABBIT malware, correlated with an immediate outbound network connection from the same process.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.
Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.
Page 609 of 756