Arnold Chan
@slazTrusted contributorCompletionist
2 followers1,966 downloads3,574 copies44 likes20,345 views
7,399 detections
Filters
Last updated
All Time
Detection languages
5,494
1,006
394
169
98
Categories
2,311
1,792
1,178
1,003
910
Platforms
4,111
1,552
1,220
660
658
Products / Services
2,750
1,003
991
705
485
MITRE Techniques
2,072
1,500
1,388
1,065
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects outbound Telnet traffic initiating with a specific magic byte sequence ('|FF FB|') characteristic of the Fire Ant malware's command-and-control communication.
Detects FTP STOR commands associated with the transfer of files with a .pcap extension, which may indicate the exfiltration of captured network traffic from a network device or server.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.
This rule detects the use of raw sockets by 'ERAAgent.exe' by monitoring for socket I/O control (Ioctl) operations involving 'SIO_RCVALL'. This configuration, often associated with promiscuous mode, allows an application to capture all network traffic received by the network interface, a behavior commonly used by network sniffing tools or malicious implants to intercept sensitive data.
Detects potential web reconnaissance or scanning activity against Microsoft IIS servers. The rule identifies suspicious behavior by monitoring for high frequencies of distinct URI requests, excessive 404 Not Found status codes indicative of path brute-forcing, and the presence of known security scanning user-agents.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
This rule detects JavaScript code patterns indicative of the NovaCookies phishing kit, which employs timing-based anti-analysis techniques to detect if a web developer console is open. By checking the execution time of code via a 'clock' function and monitoring for a 'debugger' statement, the kit attempts to withhold the phishing lure from researchers.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
Detects modifications to Windows LSA and LanmanServer registry keys (RestrictAnonymous, NullSessionPipes) in conjunction with ERAAgent.exe process execution, as well as ERAAgent creating named pipes accessible by anonymous logon, which may indicate configuration tampering to facilitate unauthorized access or credential collection.
Page 733 of 740