Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,340 copies51 likes25,914 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects SCL-9 (high-confidence phishing/spam) messages that still reach an inbox, indicating an allow-list or transport-rule override, and enriches with any recent tenant mail-flow admin changes. Rewritten: removed a no-op self-join on EmailEvents and a broken exact-match join against CloudAppEvents' raw audit blob (was comparing a sender address against a whole JSON record and would never match); now excludes messages later auto-remediated (e.g. ZAP-quarantined) via the native LatestDeliveryLocation field, and correlates admin rule/allow-list changes via substring match over a cross join.
Detects the PoisonedRefresh implant's UNIX domain socket backdoor by (1) file activity on the uniquely-named /run/bigtlog.pipe socket initiated by an Apache/httpd process, and (2) process command lines containing the implant's hardcoded authentication token. Removed the earlier generic 'bash spawned by httpd' heuristic, which fired on legitimate CGI/mod_php/admin automation that shells out from the web server and was the dominant false-positive source.
Detects attempts to exploit the Log4j vulnerability (CVE-2021-44228) by identifying JNDI lookups (ldap, rmi, http, ldaps, dns) in inbound HTTP traffic. These lookups are a hallmark of the Log4Shell attack vector, allowing for remote code execution.
Detects PHP scripts that masquerade as WordPress cache classes but contain functionality for decrypting commands using AES-256-CBC and executing them via shell_exec. The detection identifies the presence of hardcoded encryption keys, use of php://input, and common PHP obfuscation/encryption methods alongside shell execution functions.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects the invocation of the AppInstaller executable to install .msix packages, often used in software installation or malicious delivery scenarios involving application deployment.
Detects the execution or presence of files, processes, or paths associated with the 'SnowKiller' malware or tool, as identified by keyword matching in process event logs.
Page 640 of 756