Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,351 copies51 likes25,947 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Detects execution or file presence associated with HOOKEDGE/HEADLACE malware. This rule uses a dual-approach: matching known malicious file hashes (SHA256) and monitoring for specific script files (bat, vbs, cmd) following a GUID-formatted naming convention typically used by the HOOKEDGE installer chain.
Detects execution or file presence associated with HOOKEDGE/HEADLACE malware. This rule uses a dual-approach: matching known malicious file hashes (SHA256) and monitoring for specific script files (bat, vbs, cmd) following a GUID-formatted naming convention typically used by the HOOKEDGE installer chain.
This rule detects administrative SQL statements (ALTER ROLE, CREATE ROLE, or GRANT) that assign the REPLICATION attribute to a database role. The REPLICATION attribute in PostgreSQL allows a user to initiate streaming replication and perform logical decoding. This is a security-sensitive privilege, as users with this attribute can potentially bypass standard access controls or, if the environment is misconfigured or vulnerable (e.g., CVE-2026-6471), potentially leverage malicious replication plugins to achieve arbitrary code execution.
Detects an attempt to exploit CVE-2026-14894 within the Super Forms plugin by sending a crafted HTTP POST request to admin-ajax.php. The attack attempts to upload an obfuscated PHP web shell disguised as a base64-encoded GIF image.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
Page 628 of 756