nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects known mutexes associated with Fangao loader activity.
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detects execution of curl.exe uploading data to temp.sh using custom user-agent parameters, consistent with publicly reported malicious Notepad++ updater activity.
Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.
Detects network traffic to local proxy on port 7152 associated with malicious NuGet package C2 behavior.
Detects network connections to phishing domains mimicking Windows 11 download pages used to distribute infostealer malware.
This rule detects attempts to access specific Active Directory object types (identified by their GUIDs) with an access mask of 0x100 (which typically indicates 'Write Property' access). It filters out common service accounts and system accounts to reduce noise.
Detects PowerShell execution with Unrestricted execution policy combined with suspicious flags or uncommon script extensions.
Page 58 of 70