Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,348 copies51 likes25,922 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects indicators of the ProRAM malware dropper, specifically identifying the download of 'sideload.exe' from an external IP or the presence of file artifacts related to its staging process in %TEMP% and %LOCALAPPDATA% directories.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
Detects evidence of persistence mechanisms associated with the StyleSmuggler implant. The rule monitors for malicious crontab entries and file system activity related to gvfsd-user, .gvfsd, and /tmp/.kw_ artifacts.
Detects a discrepancy between the SHA256 hash of a running process image (via /proc/<pid>/exe on Linux) and the hash of the corresponding binary file on disk. This behavior is indicative of process memory manipulation, such as fileless execution or binary replacement, where the code currently running in memory does not match the original file on disk.
This rule detects a high volume of inbound network connection attempts to the default Redis port (6379) originating from local loopback or local host addresses, excluding known legitimate Redis and web server processes. This activity is indicative of potential unauthorized access attempts or exploitation of local Redis instances.
Detects the presence of PHP code execution patterns (eval, base64_decode, system, shell_exec) injected into Magento log or report files (var/report/, var/log/system.log), indicative of log poisoning used for web shell staging.
Detects suspicious GET requests to the Magento '/customer/section/load/' endpoint with specific parameters ('sections=customer' and 'force_new_section_timestamp=true'). These requests are indicative of reconnaissance activity related to the StyleSmuggler campaign, potentially associated with exploitation of Magento vulnerabilities such as CVE-2025-54236.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
Page 639 of 756