Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,408 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of script interpreters (powershell, cmd, mshta, etc.) spawned directly by explorer.exe via the Run dialog, commonly associated with 'ClickFix' social engineering attacks where users are prompted to copy and paste malicious commands to bypass security mechanisms.
This rule detects two distinct exploitation patterns: first, WinRAR (CVE-2023-38831) spawning script interpreters as child processes, typically indicative of opening malicious archives. Second, explorer.exe (CVE-2023-36025) spawning hidden PowerShell sessions, a technique used to bypass Windows SmartScreen protections via malicious LNK shortcuts.
Detects specific C2 communication patterns associated with SCKIT, including HTTPS beaconing to the skyleen.fr domain and structured URI patterns used for configuration and status requests.
Detects the Sckit supply chain implant reading sensitive credential files from a user's home directory. The rule monitors processes spawned by Node.js or Python interpreters (the primary loaders for the Sckit worm) attempting to access high-value files like SSH keys, .npmrc, .pypirc, and various token storage files, indicating potential credential harvesting behavior.
Detects the execution of a .pif (Program Information File) process where the filename contains keywords suggestive of image files (e.g., 'image', 'photo', 'scan'). Adversaries often use this technique to trick users into executing malicious code by masquerading the file type.
Detects the execution of rundll32.exe with the '/sta' command-line flag and a GUID-formatted CLSID. This technique is often used by malware (e.g., DarkME RAT) to proxy execution through COM components, which hides the actual path of the loaded DLL or payload, aiding in evasion.
This rule detects the execution of 'clspack.exe' from within the AppData\Microsoft directory. 'clspack.exe' is a legitimate Windows utility normally residing in System32 or SysWOW64. Execution from user-writable directories like AppData is a common indicator of masquerading or binary hijacking.
Detects suspicious modifications to Windows Registry keys associated with URL protocol handlers or automatic startup mechanisms. Adversaries often use custom URL schemes or registry run keys to maintain persistence or execute malicious code when a specific protocol is invoked or upon user logon.
Detects instances where a signed executable, typically a security or trusted system binary, loads an unsigned DLL from a user-writable, non-default directory (e.g., Temp, AppData, ProgramData). The rule specifically targets common system or vendor library names, indicating potential DLL search-order hijacking used to execute malicious code within a trusted process context.
Detects the use of legitimate data-transfer utilities (rclone, MEGA client, restic, WinSCP) configured to exfiltrate data to cloud storage providers. This behavior is identified as a precursor to double-extortion ransomware attacks, where attackers steal sensitive data before encrypting it.
Page 114 of 1168