Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,327 copies51 likes25,810 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound network traffic from internal hosts to the HiveMQ public broker using the MQTT protocol over TLS, a behavior associated with the Toy Ghouls mqtt-bird-agent C2 infrastructure.
Detects modifications to the 'metrics_interval' registry value within the 'Software\SynapseAgent' key. This activity suggests configuration changes to the SynapseAgent, which could indicate tampering with agent telemetry or polling frequency.
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
This rule detects modifications to Windows Registry persistence keys (Run and RunOnce) associated with specific suspicious filenames ('cplsupport.exe', 'wtass.exe'), as well as modifications to specific Synapse agent configuration registry keys. These patterns are often associated with persistence mechanisms or unauthorized software configuration changes.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
Detects outbound HTTP traffic originating from a WordPress host containing specific signatures associated with the Mushr00w Uploader webshell, indicating command-and-control communication or data exfiltration.
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
This rule detects the use of raw sockets by 'ERAAgent.exe' by monitoring for socket I/O control (Ioctl) operations involving 'SIO_RCVALL'. This configuration, often associated with promiscuous mode, allows an application to capture all network traffic received by the network interface, a behavior commonly used by network sniffing tools or malicious implants to intercept sensitive data.
Page 698 of 755