Bhojraj Joshi
@cybrbhojrajjoshiCompletionist
2 followers1 download157 copies6 likes10,646 views
30 detections
Filters
Last updated
All Time
Detection languages
30
Categories
12
11
7
6
6
Platforms
24
8
8
1
1
Products / Services
7
2
1
1
1
MITRE Techniques
12
10
7
7
4
CVEs
1
Detects non-browser processes making DNS queries to the Telegram Bot API. This activity is indicative of malware using Telegram for Command and Control (C2) communications or data exfiltration, such as Amnesia RAT.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
Detects the use of iptables to drop incoming SSH traffic (port 22) on Linux, a behavior observed in KadNap botnet infections. This rule specifically looks for the execution of the `iptables` command with parameters to set an INPUT rule, specify TCP protocol, target destination port 22, and set the jump target to DROP.
Detects command line execution indicative of the ToastNotify tool, which is used for weaponizing toast notifications. The rule specifically looks for the 'ToastNotify' string in the command line along with arguments like 'getaumid', 'sendtoast', or 'custom' followed by an XML file.
This rule detects outbound network connections from endpoints to specific, potentially suspicious, IPv4 address ranges (162.220.234.0/24 and 162.220.232.0/24). Such connections could indicate command and control (C2) activity, data exfiltration, or communication with malicious infrastructure.
No description available.
No description available.
This rule detects instances where MSBuild.exe initiates network connections to external IP addresses. MSBuild.exe is a legitimate Microsoft utility, but it can be abused by adversaries to proxy execution of malicious code and establish command and control (C2) communications. The rule filters out connections to internal, loopback, and non-routable IP spaces to focus on potentially malicious external communication attempts.
No description available.
Page 1 of 3