Arnold Chan
@slazTrusted contributorCompletionist
2 followers1,966 downloads3,571 copies44 likes20,319 views
7,399 detections
Filters
Last updated
All Time
Detection languages
5,494
1,006
394
169
98
Categories
2,311
1,792
1,178
1,003
910
Platforms
4,111
1,552
1,220
660
658
Products / Services
2,750
1,003
991
705
485
MITRE Techniques
2,072
1,500
1,388
1,065
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
No description available.
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
KQL Query
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
This rule detects the execution of arbitrary commands via the Windows Subsystem for Linux (WSL) by monitoring process creation events where 'wsl.exe' is the executable. It specifically looks for command lines that include flags like '--exec' or '-e', or common shell commands and downloaders such as 'curl', 'wget', 'bash -c', 'sh -c', 'nc ', or 'ncat '. This activity can indicate an adversary leveraging WSL to execute malicious code or bypass security controls.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
Page 740 of 740