nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects attempts to bypass authentication in SolarWinds Web Help Desk by exploiting the page restoration mechanism (CVE-2025-40552, CVE-2025-40554). An attacker can specify a sensitive page via the 'wopage' parameter to gain access to post-authentication functionality without valid credentials.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Detects attempts to exploit a deserialization vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use non-standard hex escape sequences (e.g., `\xNN`) in JSON payloads to bypass security filters and achieve remote code execution.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
Detects the use of netsh.exe to create a firewall rule that blocks all outbound traffic. This technique is often used by attackers to isolate a compromised host from external resources (like security tool cloud consoles) while maintaining internal network access for lateral movement.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects known mutexes associated with Payload ransomware activity.
Detects known mutexes associated with Chrysalis backdoor activity.
Detects Microsoft PowerPoint spawning a command-line interpreter (cmd.exe or powershell.exe) to perform suspicious file operations. This behavior was observed in an APT36 campaign where a malicious PowerPoint Add-in (.ppam) was used to create staging directories and extract embedded payloads.
Page 57 of 70