Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,317 copies51 likes25,751 views
7,544 detections
Filters
Last updated
All Time
Detection languages
5,639
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
918
Platforms
4,191
1,622
1,250
676
670
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,515
1,408
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects unexpected crashes of major security software agents (e.g., Antivirus, EDR) that are not associated with authorized vendor update or installation activities, potentially indicating tampering or exploitation attempts to disable security controls.
This rule detects attempts to modify file or directory permissions (e.g., using icacls, takeown, chmod, or chown) on paths associated with known security products. Such activity is often indicative of an adversary attempting to tamper with, disable, or exclude security tools from logging or inspection.
This rule detects attempts to modify file or directory permissions (e.g., using icacls, takeown, chmod, or chown) on paths associated with known security products. Such activity is often indicative of an adversary attempting to tamper with, disable, or exclude security tools from logging or inspection.
This rule detects potential reflective code injection or in-memory loading (fileless) where a DLL or PE image is loaded by mshta.exe or powershell.exe, but the module load event lacks a valid file path on disk (or indicates a device path). This behavior is often associated with the execution of malicious payloads such as the Amatera loader, where payloads are executed directly in memory to evade file-based security detections.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
Detects attempts to install or modify the 'WMI Provider Host' (WmiPrvSE) service, which is a common technique used by adversaries for persistence or to masquerade malicious activity. The rule monitors process execution, registry modifications, and service installation events specifically targeting this service name.
Detects WinRAR SFX droppers deploying CCProxy proxy server with associated configuration and account files (CCProxy.ini, AccInfo.ini, renamed svchost.exe)
Detects WinRAR SFX droppers deploying CCProxy proxy server with associated configuration and account files (CCProxy.ini, AccInfo.ini, renamed svchost.exe)
Detects WinRAR SFX droppers deploying CCProxy proxy server with associated configuration and account files (CCProxy.ini, AccInfo.ini, renamed svchost.exe)
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Page 725 of 755