Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network activity (DNS, TLS, HTTP) associated with suspected C2 infrastructure hosted on Cloudflare Workers, specifically identifying patterns consistent with trojanized authentication pages acting as browser-based C2 relays or WebRTC/WebSocket signaling channels.
Detects two-stage communication pattern used by the Lorem Ipsum Loader. The first stage involves a GET request to a specific host acting as a dead-drop resolver to retrieve configuration. The second stage involves a POST request to an external destination containing a JPEG file header, characteristic of image-based C2 traffic.
This rule detects DNS queries, TLS SNI, and HTTP requests to a list of known malicious domains associated with the STAC4924 threat activity, specifically linked to the TerminalFix or Lorem Ipsum Loader malware.
Detects a sequence of network events where a host downloads a portable Python embeddable package from python.org, followed by a subsequent attempt to establish a WebSocket connection. This pattern is indicative of potential command and control (C2) activity using a Python-based tunnel.
Detects the creation or modification of Google Cloud Config Connector (KCC) IAM resources (IAMPolicyMember, IAMPartialPolicy, IAMPolicy) that assign high-privilege roles like 'roles/owner' or 'roles/resourcemanager.organizationAdmin'. This monitors for potential privilege escalation where a low-privilege actor leverages the KCC controller's high-privilege service account to perform unauthorized IAM binding changes on Google Cloud resources.
Detects when the Google Cloud Config Connector (KCC) service account is granted highly privileged roles (roles/owner or roles/resourcemanager.organizationAdmin) at the Organization scope. This pattern is indicative of a potential 'ConfigConfusion' confused-deputy attack, where a compromised Kubernetes namespace with IAMPolicyMember creation rights could be used to escalate privileges to Organization Owner.
Detects the execution of the sckit Go implant, linked to the MemTensor supply chain compromise, during its host-profiling stage. The rule monitors for the 'sckit' binary being executed with 'stage0' and '--config64' command-line arguments, or being spawned by legitimate runtime interpreters like Node.js or Python, indicating an attempt to profile host information (timezone, language, privileges) and subsequent self-deletion.
Detects execution of potentially malicious scripts (a2.cmd) or unusual DLL loading behavior via rundll32.exe. This activity is often associated with staging or executing malicious payloads using non-standard naming conventions.
Detects potential staging and execution chains involving remote MSI file fetching via msiexec.exe, or the execution of .wsf scripts or registry imports originating from or residing in AppData directories. This behavior is indicative of multistage malware delivery or persistence mechanisms where components are downloaded and executed using LOLBins.
Detects instances where rundll32.exe loads a DLL file named Use.dll from a subdirectory named 'ComponentsFolder' within the AppData directory. This pattern is indicative of sandbox evasion techniques used by malware, such as the DarkMe RAT, where the DLL acts as an anti-sandbox gateway to check the execution environment.
Page 133 of 1168