Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,098 copies47 likes38,487 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of PsExec to remotely execute binaries on target hosts, a technique observed in The Gentlemen ransomware lateral movement phase when domain controller access is unavailable. The rule identifies psexec.exe process creation with common flags (-s, -d, -c) while filtering out common administrative parent processes.
Detects lateral movement activities associated with The Gentlemen ransomware group. The rule monitors for the execution of PowerShell scripts named 'deploy_gpo.ps1' from the %TEMP% directory, PowerShell interactions with the NETLOGON share for malware distribution, creation of ScheduledTasks.xml via PowerShell (a common GPO manipulation technique), and the subsequent enforcement of policy changes using 'gpupdate /force' invoked by scripting engines.
Detects the specific sequence of administrative utilities used by Gentlemen ransomware to seize control of files before encryption. This involves using 'takeown.exe' to claim ownership, 'icacls.exe' to grant full access to the Everyone group, and 'attrib.exe' to remove read-only file attributes, a common precursor to mass file encryption.
Detects ClickFix-style social engineering attacks where a user is tricked into manually executing a PowerShell command. The command typically utilizes Invoke-RestMethod to fetch a remote payload and Invoke-Expression to execute it in memory, bypassing execution policies. This behavior is commonly associated with campaigns like SmartApeSG and DeepLoad.
Detects the DeepLoad malware staging process injection by spawning trusted Windows binaries (LockAppHost.exe, makecab.exe, or Magnify.exe) in a suspended state from an unauthorized parent process. This behavior is indicative of an APC-based injection sequence where malicious code is written into the suspended process before execution.
Detects the execution of PowerShell scripts 'first.ps1' and 'main1.ps1', which are components of a known credential phishing toolset. This tool displays a fake Windows Update dialog to trick users into providing their credentials, which are then exfiltrated via SMB, DNS, or HTTP.
Detects the loading of radcui.dll from the non-standard %LOCALAPPDATA%\Microsoft\RemoteApp\Gateway\ directory. This behavior is associated with DLL sideloading chains where signed Microsoft binaries (such as wkspbroker.exe) are abused to load malicious payloads, often seen in the PREY-0058/Aur0ra Teams vishing campaigns.
Detects instances where a Node.js process spawns another Node.js process to execute a JavaScript file located within the node_modules directory. This pattern is commonly observed when malware or malicious scripts attempt to execute payloads from within project dependencies, potentially hiding malicious activity within seemingly legitimate library paths.
This rule detects potentially malicious activity involving Node.js modules. It monitors for the deletion of specific 'sharedLoad.min.js' or 'extended' files within 'node_modules' directories, the execution of Node.js processes attempting file deletion operations (like 'unlink' or 'rm') within 'node_modules', and the creation or modification of JavaScript files within 'node_modules' that contain 'btree' references. This activity may indicate an attempt to tamper with application dependencies, inject malicious code, or remove artifacts.
Detects execution of Node.js processes loading specifically named JavaScript files ('sharedLoad.min.js') within the 'node_modules/indexed-btree' directory, or file modifications involving these specific paths, which may indicate a malicious loader or supply chain compromise attempt.
Page 228 of 1168