Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,522 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to impair or disable Microsoft Defender Antivirus through unauthorized exclusion paths, Registry modifications, tampering with protection settings, or forcing policy updates.
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698, specifically filtering for tasks that execute PowerShell, WScript, or JavaScript files. This behavior is indicative of potential persistence mechanisms, such as those observed in the LausivLoader.
This rule detects attempts to exploit CVE-2021-33044 in Dahua devices, specifically targeting the NetKeyboard clientType during the global.login RPC request. This vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms.
This rule detects the creation of XML files matching the 'export_batch_*.xml' naming convention, which is consistent with the output pattern of the Dahua DeviceManager utility. Attackers often use this tool to export camera configuration files containing sensitive credentials (IP, Port, Username, Password). The rule flags activity where multiple such files are created in a short duration, suggesting potential mass exfiltration of camera credentials.
Detects the creation of Windows scheduled tasks using schtasks.exe that exhibit high-risk indicators, such as targeting temporary or user-writable directories (Temp, AppData), setting high-privilege execution flags, or utilizing PowerShell with encoded payloads. These behaviors are commonly associated with the installation of persistence mechanisms by threat actors.
Detects the creation of new services consistent with PsExec or PAExec lateral movement. The rule monitors for Windows Event IDs 7045 and 4697 where the service name uses common PsExec/PAExec naming conventions or the image path points to suspicious locations such as admin shares or temporary directories often used by these tools for binary staging.
Detects the execution of known privilege escalation tools and the use of specific Windows privilege keywords (such as SeImpersonatePrivilege) often associated with access token manipulation and token impersonation attacks to elevate privileges to SYSTEM.
Detects instances where rundll32.exe is executed with suspicious command-line parameters that are often associated with malicious activity. This includes attempts to dump memory (comsvcs.dll), utilize specific protocols (url.dll), execute JavaScript, or leverage common writeable directories for payload staging, all of which are common techniques used by attackers to proxy execution and evade defenses.
Detects attempts to disable Windows Defender features via PowerShell, terminate critical security services using administrative tools like sc.exe or net.exe, or inject/patch AMSI (Antimalware Scan Interface) within a process context to evade detection.
Detects instances where the Terraform process initiates a 'go run' command or references specific Go-based provider source files, which may indicate an attempt to run malicious or unauthorized Go code within the infrastructure-as-code environment. This behavior is indicative of supply chain compromise where providers are leveraged to execute arbitrary logic.
Page 271 of 1168