Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,328 copies51 likes25,833 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects a specific self-deletion technique used by the GRAYRABBIT loader, which utilizes NTFS Alternate Data Streams (ADS). The malware uses SetFileInformationByHandle with FileRenameInfo to rename the file to an ADS (colon-delimited), followed by FileDispositionInfo to mark the file for deletion upon handle closure, effectively bypassing standard file deletion alerts. This rule is scoped to processes originating from common user-writable or temporary directories while excluding known legitimate software installers.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid, repetitive queries to system hardware identifiers (DMI, CPU info, virtualization attributes) commonly used by adversaries for reconnaissance or environment awareness (sandbox detection). The rule identifies suspicious behavior by tracking the execution of commands like 'cat', 'grep', or 'dmidecode' that target sensitive Linux system files (e.g., /sys/devices/virtual/dmi/id/*, /proc/cpuinfo) when performed by non-standard parent processes in a short time window.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Page 679 of 755