Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,520 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of reg.exe to query the MachineGuid value from the Windows Registry (HKLM\SOFTWARE\Microsoft\Cryptography). This behavior is often associated with adversary reconnaissance, specifically host fingerprinting, to uniquely identify compromised machines.
Detects unauthorized or non-standard processes attempting to access sensitive browser cookie storage files, which is a common technique used by credential-stealing malware to exfiltrate session data and bypass multi-factor authentication.
Detects a suspicious staging behavior associated with OnyxC2 premium-tier malware. The detection identifies a process respawning itself—a common precursor to hidden VNC or credential access activity—followed by the execution of Microsoft Edge with specific utility flags typically used to masquerade as an indexing component. This pattern is characteristic of techniques used to hijack authenticated browser sessions for C2 purposes.
Detects the execution of ServiceModelReg.exe from the standard .NET Framework directories. While this utility is a legitimate tool used for registering and configuring WCF components, its abuse has been observed in the wild by threat actors, including the OnyxC2 malware, to leverage built-in Windows utilities for suspicious activities.
Detects the presence of an OnyxC2 sideloaded DLL, identified by the filename 'borlndmm.dll', masquerading as an NVIDIA graphics library. The rule identifies suspicious files that are unusually large (50MB-200MB) with high entropy, suggesting an encrypted payload appended to the file. It also looks for associations with known loaders like 'ABRSubProcess.exe' or 'Setup_File_92.118.3096.exe' and the 'ACCA software S.p.A.' digital signature.
Detects reconnaissance activity targeting sensitive personnel groups (payroll, HR, finance) via Microsoft Graph API. The rule identifies suspicious URI patterns combined with the use of the 'axios' User-Agent library, potentially indicating automated enumeration by an adversary to map high-value targets for future business email compromise or credential theft.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects instances where processes other than standard web browsers attempt to access sensitive browser data files, such as cookies, login data, and browser state files. This behavior is a common indicator of credential theft or browser session hijacking, often performed by stealer malware like OnyxC2.
Detects instances where processes other than standard web browsers attempt to access sensitive browser data files, such as cookies, login data, and browser state files. This behavior is a common indicator of credential theft or browser session hijacking, often performed by stealer malware like OnyxC2.
Detects instances where a process spawns a child process using the exact same executable image path, specifically when the executable is located in user-writable directories such as Downloads or AppData\Local\Temp. This behavior is a common indicator of process hollowing or self-injection techniques used by malware, such as loaders that decrypt payloads in memory and then spawn a new, hollowed instance of themselves to execute the malicious code, frequently observed during post-exploitation activities.
Page 260 of 1168