Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,416 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Once a FileFix chain succeeds, StealC and related loaders commonly establish Run/RunOnce persistence to survive reboot shortly after or before exfiltration.
Acronis TRU (Sept 2025) documented a FileFix campaign where a PowerShell loader downloads images from Bitbucket that conceal embedded malicious components, ultimately deploying a Go-based loader and StealC.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
A documented FileFix variant arrives as an HTML/MHTML email attachment styled to look like a Word document or PDF, displaying a fake 'file could not be rendered' prompt that leads into the address-bar paste.
Detects the creation of registry keys associated with the installation of Chrome or Edge browser extensions, specifically targeting the behavior exhibited by the CrashFix malware which masquerades as an ad blocker to achieve persistence.
This rule detects potentially malicious search activity in Microsoft SharePoint by monitoring for high-frequency queries that include specific site class patterns ('STS_Site' or 'STS_Web') and a document ID range search pattern ('indexdocid'). This behavior is characteristic of an adversary attempting to enumerate or scrape documents within a SharePoint environment.
Detects unauthorized processes attempting to read or modify Discord's local storage leveldb files, which store user authentication tokens, and correlates this with suspicious network activity to Discord's API or the presence of token-stealing keywords in command-line arguments.
Detects the ChainScript RAT agent (executing as node.exe from specific masquerading directory paths) scanning for and enumerating cryptocurrency wallet files, browser-stored wallet extensions, and related sensitive configuration data.
Detects the installation of a Windows service that mimics the legitimate NVIDIA File System Filter Driver (NvFsFilter). Adversaries, such as those associated with the Rapuncel infostealer, use this technique to establish persistence and evade security controls by masquerading as a common driver component.
Detects the loading of the malicious NvFsFilter driver (a BYOVD technique often used by the Rapuncel infostealer) followed immediately by a mass burst of process terminations, indicating an attempt to disable security software.
Page 125 of 1168