Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,098 copies47 likes38,494 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence of an injected script tag containing 'ganalytics-tracker-js' in HTTP server responses, a pattern commonly associated with 'ClickFix' social engineering attacks where users are tricked into copying and executing malicious commands.
Detects network connections over port 443 initiated by a process named 'rnpkeys.exe' running from a suspicious staging directory ('\ProgramData\keyroll\'). This behavior is characteristic of side-loaded payloads establishing command-and-control communication for data exfiltration.
This rule detects the execution of 'rnpkeys.exe' from within the '\ProgramData\keyroll\' directory, specifically when it loads 'rnp.dll' from the same path. This behavior is indicative of potential malicious activity, as the ProgramData directory is a common location for adversaries to stage files, and the use of custom DLL loading from this directory may suggest an attempt to execute unauthorized code or obfuscate tool activity.
This rule detects the suspicious sequential loading of 'tdwp.dll' and 'rnp.dll' by processes related to key management or encryption (e.g., 'rnpkeys.exe' or processes from a 'keyroll' folder). The detection correlates these events within a 2-minute window and highlights if the 'tdwp.dll' has a known malicious hash.
Detects the creation of a scheduled task named 'keyroll' in close temporal proximity to the execution of 'rnpkeys.exe' from 'C:\ProgramData\keyroll'. This pattern mimics the persistence mechanism used by the Sauron malware (a.k.a. Strider) to execute its loader chain.
This rule detects malicious shell execution patterns associated with ClickFix-based social engineering campaigns, such as the Macfinger AMOS campaign. It monitors for the execution of common shell utilities (curl, wget, bash, sh) with suspicious command-line parameters ('force=1') interacting with known malicious IP addresses (45.150.33.128), as well as the execution of specific malicious files or network callbacks identified in these campaigns.
This rule uses YARA to identify specific malicious files associated with the Sauron Loader malware, including the MSI installer and associated support DLLs (rnp.dll, tdwp.dll), based on their known SHA-256 hashes.
Detects anomalous, high-frequency outbound HTTPS POST requests from the 'rnpkeys.exe' process, characteristic of the Sauron Loader exfiltrating screenshot chunks (Message Type 3) to a Command and Control (C2) server.
Detects known file hashes associated with the Macfinger ClickFix campaign, including instruction text, bash scripts, and AMOS malware payloads (arm64/x86_64).
Detects process injection behaviors (e.g., remote thread creation, memory allocation) targeting the attrib.exe process. Such activity is often associated with process hollowing or reflective shellcode injection, consistent with loader behavior used to execute in-memory payloads within legitimate, rarely-used system utilities.
Page 234 of 1168