Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,078 copies47 likes38,464 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where the WindowsPackageManagerServer.exe (WinGet COM Server) is invoked to perform DSC (Desired State Configuration) operations (via ConfigurationStaticFunctions) by a process other than the standard winget.exe. This behavior is indicative of an attempt to bypass process-based monitoring of winget.exe by interacting directly with the COM API using custom or alternative tools like DSCourier.exe.
Detects HTTP and TLS activity associated with the DSCourier malware, specifically identifying attempts to retrieve configuration files disguised as common non-executable extensions (.jpg, .txt) or utilizing non-standard network ports like 8443, which are characteristic of this threat's command and control behavior.
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
Detects execution of cmd.exe with suspicious command-line patterns utilizing environment variable substring expansion (%VAR:~offset,length%). This technique is used to dynamically reconstruct and execute obfuscated commands, a method historically observed in APT37 delivery chains to hide malicious payloads and bypass simple string-based signatures.
Detects the execution of WinGet DSC backend services, ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, when launched as child processes of WinGet or DSCourier. This behavior is indicative of potential proxy execution abuse where WinGet components are leveraged to execute arbitrary code or configurations via signed Microsoft binaries.
This rule detects malicious .lnk files typically delivered as email attachments (spearphishing). It identifies shortcuts that execute cmd.exe with the /k switch, combined with environment variable substring expansion techniques designed to obfuscate multi-stage command execution chains.
Detects HTTP POST requests containing potential credential exfiltration indicators, specifically targeting the '/google.php' endpoint with 'do=login&', 'user=', and 'pass=' parameters. This pattern is associated with FlowerStorm (Storm-1167) AiTM phishing kits.
Detects outbound HTTP POST requests to a URI path '/google.php' containing suspicious parameters 'do=login&user=' and '&pass='. This pattern is indicative of credential exfiltration activities commonly associated with the FlowerStorm campaign.
Detects the execution of PowerShell scripts located in Windows temporary directories (AppData/Local/Temp or Temp) that utilize common evasion flags such as hidden window style, bypass execution policy, or non-interactive mode. This behavior is frequently associated with initial stagers, droppers, or malicious script execution.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Page 220 of 1168