Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,520 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence of a specific malicious _socket.pyd Python module associated with LegionLoader dropped into non-standard directories like 'Traiolx Custom Utils'. The detection leverages file path patterns and known file hashes of the malicious component.
Detects a suspicious process pattern where an executable running from a staging directory (Temp or Downloads) spawns a child process of itself, followed by a registry modification performed by that child process. This behavior is indicative of malicious loaders, such as OnyxC2, that sideload components and establish runtime configurations before C2 communication.
Detects the execution of wmic.exe when launched by uncommon parent processes, specifically mshta.exe or wscript.exe. These parent processes are often associated with the execution of malicious scripts (e.g., .hta or .vbs files), which may use wmic.exe for system discovery or execution of commands, a common pattern in file-based living-off-the-land attacks.
Detects modifications to Windows Registry Run keys that execute PowerShell scripts named 'Update.ps1' with hidden window and bypass execution policy flags. This pattern is consistent with Lightlife RAT persistence mechanisms.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Detects the execution of wscript.exe as a child process of mshta.exe, specifically when the wscript.exe command line contains references to .vbs or .js files. This behavioral pattern is often associated with malicious HTA files using mshta.exe as a proxy to execute secondary script payloads, a technique commonly leveraged for initial access and execution.
Detects network activity associated with the GhostCode phishing kit backend. The rule monitors for specific API endpoints used for credential and MFA harvesting, including loading configurations, geolocation, and polling for captured data, combined with specific session cookie identifiers.
Detects modifications to the Windows Registry designed to disable PowerShell ScriptBlockLogging. This is a common defense evasion technique used by attackers to hide malicious PowerShell commands and scripts from security monitoring.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
Detects the creation or modification of Windows Registry Run/RunOnce keys that reference msbuild.exe without typical build arguments. This is often used by adversaries to maintain persistence by executing malicious XML-based projects or inline C#/VB code via a trusted system utility.
Page 261 of 1168