Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,327 copies51 likes25,818 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
This rule detects potential VNC remote access activity by identifying systems that exhibit both the presence of specific VNC configuration/history files (AccInfo.ini, History.txt) and concurrent network activity on port 10635, which is commonly associated with VNC-like remote access tools.
Detects instances where PowerShell is used to download an executable named 'svchost.exe' from an external IP address (103.86.86.244). The rule monitors for network connections to this IP, file creation events matching specific download patterns in fonts directories, and direct command-line arguments involving the suspicious IP and file path, indicating potential malware dropper activity.
Detects SoftEther VPN bridge dropper/installer disguised as svchost.exe with masquerading MixedRealityOpen service, based on install script and dropped files (a.Bat, hamcore.se2, vpn_server.config)
Detects the use of the Windows reg.exe utility to copy Registry keys related to Radmin, a legitimate remote access tool that is frequently abused by threat actors for persistence and remote control. The command-line arguments /s and /f indicate a silent, forced copy operation, which is characteristic of script-based configuration tampering.
Detects the use of the native Windows registry utility 'reg.exe' to import configuration files (install.reg) related to the Radmin remote access software, specifically targeting the security settings registry path.
Detects the use of the native Windows registry utility 'reg.exe' to import configuration files (install.reg) related to the Radmin remote access software, specifically targeting the security settings registry path.
Detects the use of the native Windows registry utility 'reg.exe' to import configuration files (install.reg) related to the Radmin remote access software, specifically targeting the security settings registry path.
This rule detects potentially malicious PowerShell execution patterns involving hidden windows, administrative elevation via 'Start-Process -Verb RunAs', and the targeting or execution of rsetup64.exe within specific system paths. It also flags execution chains where 'net session' commands, often used for discovery or local privilege verification, are piped to null and followed by or initiate the same target executables, suggesting lateral movement or persistence attempts.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Page 687 of 755