nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,820 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. This rule helps identify potential compromise or reconnaissance related to the FortiBleed vulnerability.
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the execution of PowerShell from explorer.exe (the Windows Shell) involving commands that access the clipboard, which is a common indicator of the ClickFix social engineering attack technique. In this scenario, users are deceived into copying and pasting malicious commands into the Run dialog.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
This rule detects a burst of Okta Multi-Factor Authentication (MFA) push prompts to a single user within a short time window, indicating a potential MFA bombing or fatigue attack. It specifically looks for scenarios where at least 5 push notifications are sent, and at least one is approved, suggesting the user might have caved under pressure. The rule also enriches the data with client IP, geographical context, and proxy information to aid investigation.
Page 8 of 70