Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,077 copies47 likes38,463 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the suspicious initiation of Control Panel applet functionality via the COM object 'COpenControlPanel'. Adversaries may leverage this COM interface or the associated 'CPL_INIT' message to proxy malicious code execution through standard Windows processes like dllhost.exe or rundll32.exe, effectively bypassing security controls that might otherwise flag the direct execution of malicious .cpl files.
Detects the creation of files with the .ent extension within the Microsoft Internet Explorer directory. This behavior is associated with the NarwhalRAT malware, which uses this specific file extension and location to store AES-encrypted configuration files, likely for persistence or subsequent execution by the malware.
Detects the execution of 'userscreen.exe' (a renamed pythonw.exe used by NarwhalRAT) loading 'user32.dll'. This behavior is associated with the use of ctypes in Python to perform window enumeration via EnumWindows, specifically used by the malware to identify and monitor KakaoTalk application windows.
This rule detects the deletion of critical Windows Defender security files (such as drivers and executables) by the System process. This behavior is highly indicative of an attempt to tamper with or disable security features on a host.
Detects modifications to the Windows legal notice registry keys (legalnoticecaption, legalnoticetext) under the System policies registry hive. These keys are used to display a message to users during the login process, and are frequently abused by adversaries for persistence messaging, defacement, or to deliver payloads via social engineering.
This rule detects modifications to Group Policy Objects (GPOs) performed by accounts identified as domain administrator-equivalent (based on naming conventions) within 60 minutes of a successful logon from a device, potentially indicating GPO weaponization by an adversary using a compromised account.
Detects the presence of PAYLOAD ransomware ELF binaries specifically configured to target VMware ESXi environments. The detection logic looks for a combination of ELF magic bytes, the 'PAYLOAD' string, references to common virtual machine file extensions (e.g., .vmdk, .vmx), and usage of ESXi-specific administration tools such as esxcli or vim-cmd.
Detects unauthorized attempts to disable or modify Windows Firewall settings across multiple devices. The rule identifies suspicious registry modifications, firewall service termination events, or security policy changes that suggest an adversary is attempting to impair defensive mechanisms.
Detects sign-in activity using the OAuth 2.0 device code flow, followed by subsequent authentication attempts from the same account originating from anomalous, previously unseen geographic locations or using unfamiliar applications. This pattern is indicative of a device code phishing attack where an adversary lures a user into authorizing a malicious device or application and subsequently hijacks the resulting session to access resources from a different location.
Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.
Page 219 of 1168