Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential abuse of Windows Management Instrumentation (WMI) for process execution. It monitors for wmic.exe creating processes, PowerShell cmdlets Invoke-WmiMethod or Invoke-CimMethod used for remote execution, and unexpected process spawns from the WmiPrvSE.exe provider service, which are common indicators of lateral movement and remote command execution.
Detects the creation of WMI event subscriptions via wmic.exe, PowerShell, or the compilation of MOF files. These techniques are commonly used by adversaries to establish persistence or execute malicious payloads by binding event filters to event consumers.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell by identifying specific commands used to manipulate the AmsiUtils class or its field values in memory.
This rule detects unauthorized or suspicious cross-process access attempts by monitoring relationships between source and target processes. It specifically flags instances where common target processes (e.g., browsers or core system processes) are accessed by a source process that is not on a known allowlist of legitimate parent/child or service-related processes. This pattern is often indicative of process injection or unauthorized memory access attempts.
Detects the use of PowerShell to perform COM database enumeration, often associated with OleViewDotNet or NtObjectManager tools, specifically looking for indicators of COM object querying such as InProcServer32 path identification.
Detects HTTP beaconing and command-and-control (C2) communication patterns associated with the Exvicy malware family. This includes heartbeat polling, victim fingerprinting registration, and CAPTCHA handling over HTTP GET and POST requests to the '/api.php' endpoint.
This rule detects specific JavaScript helper functions and state machine constants commonly used in 'ClickFix' phishing campaigns (e.g., Exvicy and ErrTraffic). These scripts typically prompt users to copy and paste malicious code snippets, often disguised as error fixes or CAPTCHA resolution, to facilitate initial access.
Detects DNS queries, HTTP requests, and TLS SNI traffic directed towards the domain 'cloudflare-check.net', which is associated with 'ClickFix' social engineering campaigns used to deceive users into executing malicious code.
Detects the execution of obfuscated PowerShell commands (using -EncodedCommand, -WindowStyle Hidden, and -NonInteractive or -NoProfile flags) spawned by a process located within an Electron application's AppData directory. This pattern is commonly associated with malicious scripts or post-exploitation activities launched by Electron-based applications, excluding the Windows shell (explorer.exe).
Detects the exploitation of WinRAR CVE-2023-38831, where a maliciously crafted archive triggers WinRAR to execute a secondary payload (such as a script, LNK, or binary) from its temporary extraction directories (Rar$EXa, Rar$DIa, Rar$SR). This behavior is characteristic of adversaries using WinRAR as an initial access vector to bypass security controls.
Page 189 of 1168