nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
Detects EvilTokens phishing kit gate check requests to /api/device/gate/ used to identify and burn phishing pages for security researchers
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe).
Detects the execution of 'docker pull' or 'docker run' commands, excluding common base images like Microsoft, Ubuntu, Debian, and Alpine. This rule aims to identify potentially unauthorized container deployments or image pulls that could indicate malicious activity within a containerized environment.
Detects the creation of a scheduled task via schtasks.exe that involves PowerShell executing commands via IEX and IRM, a technique associated with the DeepLoad malware to maintain persistence.
Detects anomalous web session traffic that proxies enterprise authorization endpoints (e.g., oauth, saml, login) while simultaneously interacting with session-related cookies. This behavior is indicative of an Adversary-in-the-Middle (AiTM) proxy setup used to capture session tokens and bypass authentication.
Page 23 of 70