Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,420 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence of an unpacked Sauron Loader DLL by identifying a specific embedded configuration header (magic value 0xbaadf00d followed by flags 0x40) in conjunction with configuration fields like 'group_id' or 'build_id'. This rule is intended for static analysis of file samples.
Detects unauthorized or suspicious persistence attempts where Windows Package Manager (WinGet) configuration processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe) write to the Windows 'Run' registry keys in HKLM. This behavior can be abused to execute malicious code automatically at system startup.
Detects processes associated with the WinGet/DSC configuration engine (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe, or winget.exe) initiating processes with the COR_PROFILER or COR_ENABLE_PROFILING environment variables. This behavior is indicative of leveraging .NET profiler hijacking via the DSC 'Environment' resource for persistence or privilege escalation.
This rule detects the creation, modification, or renaming of .lnk shortcut files within the Windows Startup folders (both current user and roaming appdata). It then correlates this activity with the execution of AutoIt3.exe or processes identified as 'AutoIt' that are running scripts with .a3x or .au3 extensions, which are commonly used for persistence and execution of malicious automation scripts.
Detects the loading of specific DLL files (winfsp-x64.dll or DukeQt.dll) where the loading process or the DLL file location originates from outside the legitimate system directory (C:\Windows\). This behavior is often associated with DLL sideloading or search order hijacking where a malicious actor places a DLL in an untrusted directory to be loaded by a legitimate application.
Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.
Detects the execution of the Windows Workspaces Broker process (wkspbroker.exe) when it loads a library (DLL) from a path within the RemoteApp Gateway directory under LOCALAPPDATA. This behavior is associated with DLL side-loading techniques used to execute malicious payloads such as the Xray-core implant.
Detects the SharePoint application pool worker process (w3wp.exe) spawning command-line interpreters or scripting engines. This behavior is indicative of post-exploitation activity where an attacker, having gained remote code execution via techniques like insecure deserialization, executes commands or deploys in-memory webshells within the context of the IIS worker process.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.
Page 141 of 1168