Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,416 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects network traffic originating from internal hosts directed to the Telegram API endpoint 'api.telegram.org' with a URI pattern associated with bot interaction, potentially indicating usage of a Telegram-based Command and Control (C2) mechanism by the CARBONATO/Hermes agent.
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects network activity associated with the RatHat Android malware agent, including C2 tasking, Go agent 'frpc' tunnel configuration retrieval, tunnel deployment status reporting, and internal loopback C2 server communication.
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Detects a specific Android sandbox escape technique where a malicious app enables Accessibility Services and Developer Options/Wireless Debugging to initiate a self-pairing ADB connection over localhost. This bypasses typical app sandbox restrictions, allowing the execution of processes with the UID 2000 (shell) context.
Detects malicious staging and C2 activity characteristic of RatHat Android malware. The rule identifies processes running under the Android shell user (UID 2000) that execute specific tools (minicap, minitouch, or disguised libraries) from the /data/local/tmp directory, followed by an outbound network connection, which is indicative of a persistence mechanism and reverse-tunneling command-and-control communication.
Detects the creation of Windows services by known binary hosts frequently utilized by NeedyMantis for DLL sideloading. This activity is indicative of the persistence phase where the actor's 'is' module registers itself as a service to ensure survival across system reboots following the execution of the sideloading chain.
Detects NeedyMantis first-stage loader activity where a legitimate application (e.g., Poedit, curl, Vim, TightVNC) is executed to load an update or support DLL from a non-standard staging path (e.g., %ProgramData% subdirectories), followed by the presence of a co-located encrypted second-stage archive.
Detects the use of the 'getevent' utility on Android/Linux systems to monitor and capture raw input events from '/dev/input'. This technique is often used by mobile malware to perform keylogging by intercepting touch or physical keystroke event streams, bypassing standard application-level input handling.
This rule detects potentially malicious activity on Android devices where the 'shell' user is performing silent application installations using 'pm install' and subsequently granting accessibility permissions via 'settings put secure'. This sequence is indicative of malware attempting to gain elevated control over the device by bypassing user-interactive prompts for installation and permission authorization.
Page 122 of 1168