Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,353 copies51 likes25,953 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
This rule detects unauthorized modifications to browser search provider settings in the Windows Registry, targeting keys associated with Chrome and Microsoft Edge search configuration. This activity is often indicative of browser hijacking or search engine redirection campaigns, such as the NinjaMare malware.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects Evil-WinRM / WinRM-fs usage or wsmprovhost.exe-spawned PowerShell tied specifically to bird-agent backdoor artifacts (cplsupport, wtass, config.toml) or encoded/download-cradle command patterns, rather than any WinRM session, reducing noise from routine remote administration.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
Page 627 of 756