Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,530 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects batch scripts that execute renamed Mimikatz-style binaries (e.g., g.com, hs.com) for credential dumping purposes. The rule looks for the combination of command-line arguments to redirect output to text files, the subsequent deletion of the renamed binaries and associated artifacts (mimidrv.sys, temp files), and the execution of 'gpupdate /force', which is a common technique used to trigger or finalize credential dumping operations.
Detects the dllhost.exe process, running with SYSTEM privileges, loading a dynamic link library (DLL) from a user-writable path within the ProgramData directory. This behavior is consistent with the abuse of COM marshaling, specifically exploiting dangling CLSID entries to force a privileged COM host process to unmarshal and load an attacker-controlled DLL.
This rule detects the presence of Vidar Stealer version 2.0+ by identifying the specific ARX-based (Addition-Rotation-XOR) stream cipher implementation. The detection logic searches for stable cryptographic constants (FNV-1a prime and golden-ratio constants), unique per-build ARX transformation constants, and specific post-decryption artifacts in the file's binary content.
Detects the accumulator-based virtual machine (VM) skeleton used by Vidar Stealer (v2.0+) to obfuscate its internal configuration and strings. The rule specifically identifies a combination of bit-manipulation and arithmetic primitives (ROR, ROL, NOT, IMUL, ADD, SUB, XOR) acting as a dispatcher pattern within highly entropic executable sections, which is a characteristic behavioral artifact of the Vidar Stealer obfuscation engine.
Detects the presence of specific .NET deserialization gadget chain components (ExpandedWrapper, XamlServices, ObjectDataProvider, LosFormatter) within application traffic or logs, which are indicative of exploitation attempts targeting SharePoint pre-authentication remote code execution vulnerabilities like CVE-2026-65660.
Detects PE files masquerading as PuTTY executables that match the specific file size characteristics associated with the Exvicy Malware-as-a-Service (MaaS) distribution model. The rule identifies suspicious executables by looking for PuTTY-related strings in files that are either unsigned or exhibit high entropy, suggesting potential packing or malicious modification.
Detects a specific bot-cloaking technique used by the Exvicy/ErrTraffic framework, where an actor makes requests to bot-decision endpoints (index.php/white.php) while providing a spoofed 'google.com' Referer header to a non-Google destination host. This technique is often used to facilitate the delivery of fraudulent content (e.g., fake Turnstile/ClickFix pages) while evading detection by security scanners and undesired geographic regions.
Detects network activity associated with the ErrTraffic malware, specifically targeting JSON-RPC 'eth_call' requests to Polygon blockchain smart contracts used for C2 resolution and subsequent DNS queries to known malicious domains used for C2 infrastructure.
Detects the presence of a shared client-side JavaScript framework used in 'ClickFix' MaaS (Malware-as-a-Service) panels, specifically associated with the Exvicy and ErrTraffic campaigns. The rule identifies specific function patterns (e.g., xdReq, xdDec, waitForToken) and state machine logic (tokens, deduplication hashing) commonly used for token interception and clipboard interaction.
Detects the establishment of a memory-resident webshell following the exploitation of SharePoint (e.g., ToolPane/EditingPageParser SafeControls bypass or XamlServices/LosFormatter deserialization). The rule identifies instances where w3wp.exe loads specific XAML/WPF assemblies used in known gadget chains and subsequently spawns child processes without any corresponding file creation activity on disk.
Page 282 of 1168