Ali AlEnezi
@siteCompletionist
2 followers45 downloads264 copies6 likes5,288 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
This rule detects HTTP requests containing an invalid or malformed 'Transfer-Encoding' header value. Such malformations are often used in HTTP Request Smuggling (HRS) attacks to cause desynchronization between a front-end load balancer/proxy and a back-end web server, potentially allowing an attacker to smuggle requests, bypass security controls, or perform cache poisoning.
This rule monitors for HTTP header folding, a legacy evasion technique where header fields are split across multiple lines by using whitespace characters (tabs or spaces). This technique may be used by adversaries to bypass security controls such as web application firewalls or load balancers by smuggling malicious payloads or obfuscating traffic.
Detects repeated HTTP request field length anomalies which may indicate attempts to exploit buffer overflows, memory corruption vulnerabilities, or parser abuse against web services.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
KQL Query- List of known malicious IPs associated with Iranian-affiliated APT exploiting PLCs
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects network traffic to the command and control (C2) domain 'sfrclak.com', which is associated with compromised versions of the Axios npm package (specifically 1.14.1 and 0.30.4). This traffic represents the first stage of activity where dropper scripts on an affected endpoint attempt to communicate with their C2 server.
Page 6 of 8