Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,347 copies51 likes25,922 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
This rule detects unauthorized modifications to sensitive Windows registry keys related to SCHANNEL ciphers, protocols, or FIPS algorithm policies. It specifically identifies when these security settings are weakened (e.g., enabling insecure algorithms or disabling security defaults) by interactive users rather than authorized system processes or configuration management tools like Intune or SCCM.
This rule detects unauthorized modifications to sensitive Windows registry keys related to SCHANNEL ciphers, protocols, or FIPS algorithm policies. It specifically identifies when these security settings are weakened (e.g., enabling insecure algorithms or disabling security defaults) by interactive users rather than authorized system processes or configuration management tools like Intune or SCCM.
This rule detects unauthorized modifications to sensitive Windows registry keys related to SCHANNEL ciphers, protocols, or FIPS algorithm policies. It specifically identifies when these security settings are weakened (e.g., enabling insecure algorithms or disabling security defaults) by interactive users rather than authorized system processes or configuration management tools like Intune or SCCM.
Page 637 of 756