Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,286 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects network beaconing behavior consistent with Cobalt Strike's default malleable C2 profiles. It monitors HTTP GET and POST requests for specific URI patterns commonly used by default Cobalt Strike configurations and triggers when multiple such requests are observed from a single host over a 15-minute window.
Detects the deletion of Volume Shadow Copies and disabling of Windows boot recovery options using native administrative utilities such as vssadmin, wmic, powershell, wbadmin, and bcdedit. This behavior is frequently associated with pre-encryption activities in ransomware attacks to prevent system restoration.
Detects the execution of PowerShell with suspicious flags such as encoded commands (-enc, -ec, -encodedcommand) combined with execution policy bypass flags and common .NET classes or methods used for downloading content from the internet (e.g., Net.WebClient, IEX, Invoke-WebRequest). This pattern is commonly observed in fileless malware delivery or secondary payload retrieval stages.
Detects the 'ClickFix' social engineering pattern where a user is instructed to copy and paste a malicious command into the Windows Run dialog. The rule triggers on PowerShell being launched from explorer.exe with 'ExecutionPolicy Bypass', utilizing 'irm' (Invoke-RestMethod) to download content, and saving it to the user's TEMP directory via 'Out-File' for subsequent execution.
Detects the execution of batch or command scripts initiated by SQL Server (sqlservr.exe) or in contexts involving command-line utility misuse often associated with SQL Server exploitation, such as xp_cmdshell or certutil, particularly when involving paths like AppData or ServiceProfiles.
Detects suspicious command execution patterns involving cmd.exe or powershell.exe spawned by services.exe, or involving redirection to temporary files, which are consistent with Impacket-based remote service execution commonly associated with NeedyMantis malware deployment.
This rule detects potential identity-led lateral movement in two scenarios: 1) A single account performing RDP authentications to multiple distinct hosts within a short time frame (RDP Fan-Out), or 2) An RDP login occurring on a host shortly after evidence of LSASS process memory access on that same host, suggesting potential credential theft followed by immediate reuse.
Detects the execution of known Remote Monitoring and Management (RMM) tools from common staging directories (e.g., Temp, Downloads, AppData) or using command-line arguments indicative of a silent or hidden installation, which is a common pattern for initial access and persistence by adversaries.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
Detects persistence attempts by monitoring Windows Registry Run and RunOnce keys for suspicious file paths (e.g., AppData, Temp, Users\Public) or the execution of non-standard script and binary file types (e.g., .vbs, .js, .ps1, .hta, wscript, cscript, mshta). These indicators are common signs of malware or unauthorized software maintaining persistence on a system.
Page 14 of 1168