Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,537 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects attempts to exploit the authentication bypass vulnerability in Dahua firmware (CVE-2021-33045) via the JSON-RPC interface. The attacker attempts to manipulate the 'loginType' and 'ipAddr' fields, specifically using 'Loopback' as the login type and '127.0.0.1' as the IP address to bypass security controls.
Detects instances where the Windows command shell (cmd.exe) creates, modifies, or renames specific suspicious files ('My_Resume.pdf', 'Documents_Details.pdf') within the 'ProgramData' directory, often associated with execution of batch files or file copy operations that may indicate staging of malicious payloads.
Detects the use of PowerShell commands (Get-Volume, Get-Partition, Get-Disk) to identify and inspect information about connected removable storage media such as USB, IEEE 1394, SD, or MMC devices. This behavior is indicative of an adversary enumerating potential targets for data staging or exfiltration.
Detects the use of the Windows 'net.exe' utility to establish an IPC$ null session or an authenticated connection to the IPC$ share. These techniques are often used by attackers to perform remote service discovery, interact with remote shares, or facilitate lateral movement within a network.
Detects network discovery activities including ICMP sweeps, ARP cache checks, and SMB share/session enumeration, which are common tactics used for internal reconnaissance by the threat group APT36 (Transparent Tribe).
Detects the addition of a 'DailyFitnessTracker' entry to the HKCU Windows Registry Run key, which is a technique used by Golang-based RATs to establish persistence. The rule monitors both 'reg.exe' command-line operations and PowerShell 'New-ItemProperty' cmdlets targeting this specific registry path.
Detects the execution of a file with a '.Psh' extension named 'UBPPatch.Psh' that is launched by the process 'UBPUpdater.Exe'. This behavior is indicative of a masqueraded script execution where a suspicious binary or script is disguised with an unconventional extension to evade standard detection mechanisms.
Detects malicious activity involving the HTS software update mechanism, where the legitimate updater or patch processes are leveraged to download and execute the HTSPnew.exe ransomware payload.
Detects high-privilege IAM roles (roles/owner, roles/resourcemanager.organizationAdmin) being granted at the GCP organization level. This activity is indicative of the ConfigConfusion attack, where a low-privilege user exploits a Kubernetes ConfigConnector (KCC) controller's high-privilege service account to perform unauthorized IAM modifications.
Detects a specific loader sequence associated with the DarkMe malware/Water Hydra threat actor. The rule monitors for the execution of rundll32.exe with the /sta flag and a specific CLSID, followed by the presence or execution of targeted applications (cryptocurrency wallets, password managers, and system utilities) within a 15-minute timeframe. This sequence is indicative of the malware enumerating potential targets on the infected host before proceeding with malicious activity.
Page 299 of 1168