Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,393 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network traffic permitted from zones typically associated with NetScaler appliances (DMZ, perimeter, VPN, gateway) to sensitive internal zones (internal, trust, LAN, corp) using common administrative or lateral movement protocols (SMB, RDP, WinRM, RPC, LDAP). This behavior is indicative of potential lateral movement or exploitation originating from a compromised edge appliance.
This rule detects inbound network traffic directed at NetScaler ADC or Gateway devices originating from IP addresses flagged as malicious by threat intelligence feeds. It correlates activity logs with active threat intelligence data (categorized as Malware, C2, Exploit, Scanning, or related to known NetScaler/Citrix vulnerabilities) to identify potential reconnaissance or exploitation attempts.
Detects anomalous, high-frequency requests from a single source IP targeting sensitive NetScaler/Citrix ADC Gateway paths. This behavior is indicative of automated reconnaissance or vulnerability scanning often preceding exploitation attempts.
KQL Query
Detects instances where a successful login occurs on an ESXi/vCenter hypervisor, followed by the creation or power-on of a virtual machine on that same host within a two-hour window. This behavior is indicative of an attacker establishing access to a hypervisor environment to spin up rogue, unmonitored virtual machines to evade detection tools and facilitate further malicious activity.
Detects the use of the sc.exe command-line utility to stop or disable the Microsoft Defender Antivirus service (WinDefend). This activity is often associated with ransomware, such as Nova ransomware, to bypass security controls prior to malicious encryption or data destruction.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects the use of PowerShell to modify Microsoft Defender exclusion paths by adding root drive letters or temporary directory paths. This behavior is indicative of defense evasion techniques often employed by ransomware families, such as Nova or Gentlemen, to prevent the scanning of files immediately prior to encryption.
Detects attempts to terminate security-related processes (AV/EDR) using common administrative tools including taskkill.exe, wmic.exe, and PowerShell Stop-Process. This behavior is frequently observed during the pre-encryption phase of ransomware attacks, such as Nova and Gentlemen, to evade detection.
Detects attempts to terminate security-related processes (AV/EDR) using common administrative tools including taskkill.exe, wmic.exe, and PowerShell Stop-Process. This behavior is frequently observed during the pre-encryption phase of ransomware attacks, such as Nova and Gentlemen, to evade detection.
Page 101 of 1168