Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,322 copies51 likes25,793 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
Detects modifications to the 'crond' daemon binary followed closely (within 5 minutes) by a restart or start command via common system management utilities. This behavior is highly indicative of potential persistence mechanisms where an adversary replaces a system binary with a malicious version.
Detects network activity associated with the CurlRAT malware during its beaconing phase. The rule monitors for process command line arguments containing 'writeservice_info' or 'atd_get_system_info', which indicate the collection of system information, and correlates this with network connections that potentially transmit a ~10KB data payload characteristic of its check-in mechanism.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects the creation or modification of specific files within the /tmp directory, specifically those matching naming patterns associated with 'jasper-log' files or temporary pipe files. These patterns are often associated with temporary storage or data staging activities during post-exploitation or malware execution.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
Page 710 of 755