Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,327 copies51 likes25,806 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
This rule detects process command line arguments that include the string 'data.external.telemetry', which may indicate the use of specialized tools, telemetry collection agents, or unauthorized data exfiltration channels.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Detects execution of Coder-related processes or scripts where sensitive configuration parameters, such as database credentials or authentication tokens, are passed via command-line arguments. This behavior can lead to the exposure of credentials to other users or processes on the system through process listing.
Detects execution of Coder-related processes or scripts where sensitive configuration parameters, such as database credentials or authentication tokens, are passed via command-line arguments. This behavior can lead to the exposure of credentials to other users or processes on the system through process listing.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects the execution of Terraform commands (init, apply, plan) that interact with the 'registry.coder.com' domain, or direct network connections to the associated infrastructure. This may indicate the use of unauthorized or compromised Infrastructure-as-Code (IaC) modules or malicious supply chain activity involving Terraform configurations.
Detects the execution of Terraform commands (init, apply, plan) that interact with the 'registry.coder.com' domain, or direct network connections to the associated infrastructure. This may indicate the use of unauthorized or compromised Infrastructure-as-Code (IaC) modules or malicious supply chain activity involving Terraform configurations.
Page 707 of 755