Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,529 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances of rundll32.exe being executed with command line arguments that point to DLLs in common user-writable or non-standard directories (e.g., Temp, AppData, Downloads, ProgramData) or employing known malicious command patterns like Control_RunDLL, javascript: protocol handlers, or shell32.dll proxy execution techniques often used to evade security controls.
Detects msiexec.exe execution with flags intended for silent or standard installation when the source path points to a remote web resource (HTTP/HTTPS) or a UNC path. This behavior is indicative of using the native Windows Installer to proxy the download and execution of arbitrary, potentially malicious, MSI packages.
Detects the use of bitsadmin.exe to create or modify Background Intelligent Transfer Service (BITS) jobs, specifically when combined with the /setnotifycmdline flag. This technique is used by adversaries to download malicious payloads and trigger their execution upon job completion, often bypassing network security controls that might otherwise flag traditional download-and-execute activity.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to initiate process creation on remote hosts. This is achieved by combining the '/node:' flag (to specify a remote target) with the 'process call create' command. This technique is frequently utilized by adversaries and ransomware operators for lateral movement across a Windows network.
Detects the execution of the Windows built-in utility mshta.exe when it is used to load remote HTA files or scripts via HTTP/HTTPS URLs, or when it is directly spawned by Microsoft Office applications (Word/Excel). This behavior is characteristic of malicious document macros or phishing-based initial access where mshta is used as a proxy to execute code and evade security controls.
Detects the execution of Regasm.exe or Regsvcs.exe where the target assembly is located in a path other than standard Windows or .NET framework directories. This behavior is often indicative of an adversary attempting to use these signed utilities to load and execute malicious .NET payloads as a proxy, thereby bypassing application allowlisting.
Detects the execution of csc.exe (C# compiler) from non-standard directories or when compiling source files located in user-writable paths like Temp or AppData. This behavior is indicative of on-host code compilation used by attackers to bypass static antivirus detection by delivering and compiling malicious payloads on the fly.
Detects the use of bitsadmin.exe to initiate file transfers from remote URLs to sensitive or writable system directories, or the use of /SetNotifyCmdLine to define a command to execute upon job completion. These techniques are often used by adversaries to download payloads or establish persistence via BITS jobs.
Detects suspicious execution patterns of rundll32.exe, including usage for JavaScript execution, control panel file abuse, potential credential dumping using comsvcs.dll, and execution from common user-writable temporary directories.
Detects the use of WMIC to invoke XSL files or perform suspicious process creation commands, a technique often used for proxy execution or script-based attacks.
Page 278 of 1168