Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,540 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where Microsoft Visual Studio Code (Code.exe) spawns common interpreters or command-line tools (such as node, python, cmd, or powershell) that are not associated with known internal VS Code process behaviors like renderer tasks or tunnel operations. This activity may indicate malicious use of the integrated terminal or extension execution contexts to execute unauthorized code.
Detects instances where node.exe or npm processes spawn a Python interpreter. This behavior is indicative of malicious activity, specifically the execution of second-stage payloads such as the InvisibleFerret backdoor often associated with the BeaverTail JavaScript loader, observed in software supply chain compromise campaigns.
Detects the creation or modification of registry entries within the 'HKCU\...\Run' hive that point to executables located in suspicious or atypical directories such as 'ProgramData', 'Users\All Users', or specific non-standard application paths often used by malware for persistence.
Detects login attempts to source code repositories and developer tooling (GitHub, GitLab, Bitbucket, Azure DevOps, Slack, Visual Studio Code) originating from unmanaged or non-compliant devices, excluding traffic originating from known corporate network ranges.
Detects instances where a desktop messaging application (WhatsApp or Telegram) spawns a child process that matches known suspicious naming conventions or lure keywords, suggesting that a user has executed a malicious file shared via the platform.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding exclusion paths, processes, or extensions shortly after the creation of Registry Run keys. This sequence is characteristic of post-exploitation activity where an adversary establishes persistence and subsequently attempts to neutralize security software monitoring of their malicious payloads to avoid detection during future execution.
Detects execution of PowerShell commands that utilize hidden window styles and encoded payloads, specifically when the command line or image path references 'WindowsUpdate.log'. This pattern is often used by adversaries to hide malicious scripts and potentially interact with logs in an attempt to masquerade or tamper with Windows Update processes.
Detects the creation of image files (.bmp, .png, .jpg, .jpeg) by processes executing from non-standard directories such as AppData or ProgramData. This behavior is indicative of unauthorized screen capture activities often used by malware for pattern-of-life monitoring, where screenshots are staged in temporary locations before exfiltration. The rule filters out common legitimate applications known to perform screen captures.
Detects instances of common interpreter processes, specifically node.exe or python variants, accessing known cryptocurrency wallet files or mnemonic storage files on a Windows system. This behavior is highly indicative of malicious activity where an attacker uses lightweight script-based tools to perform credential harvesting or theft of cryptocurrency assets.
This rule detects anomalous authentication behavior on SonicWall VPN appliances characterized by either multiple distinct source IP addresses for a single user or a high volume of failed authentication attempts followed by a successful login. These patterns are often indicative of credential stuffing or password spraying campaigns, such as those observed in Akira ransomware affiliate initial access activities.
Page 303 of 1168