Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,540 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the deletion of Volume Shadow Copies using the Windows Management Instrumentation Command-line (WMIC) utility. This behavior is commonly observed in ransomware attacks, including those attributed to DragonForce and CRPx0, as a method to inhibit system recovery prior to file encryption.
Detects the GHAPPIER four-stage malware loader, specifically targeting npm-based JavaScript files. The rule identifies malicious activity through specific artifacts including hardcoded C2 URLs (vercel.app domains), campaign markers, file paths, and eval-based execution patterns.
Detects the deletion of 'loader.js' from the '%APPDATA%\VSCODE\' directory. This activity is consistent with the initial execution phase of GHAPPIER RAT, where the implant removes its dropper file to avoid detection and hinder forensic analysis.
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
Detects the creation of the file 'nb_hook_dbg.txt' within 'C:\Windows\Temp\', which is a specific debug artifact generated by the PIVOTPIPE loader during the initialization of its HookGate subsystem. This subsystem is responsible for implementing indirect system calls to bypass user-mode EDR hooks by decoding syscall numbers at runtime and utilizing the WoW64 transition.
This rule detects potential credential theft by correlating access to local git credential files (e.g., .git-credentials, .netrc) followed by a git push event from the same user account within 24 hours. The rule flags these pushes if they originate from an unrecognized host or an IP address outside of the trusted internal network range.
Detects malicious tampering with GitHub Actions workflows by monitoring for two specific patterns within an hour: the addition of automatic push triggers for the main branch alongside the removal of manual approval gates, or rapid sequential commits that rewrite workflows to facilitate an unattended publish of a package. This rule also integrates with npm registry publish events to identify potential malicious distribution of compromised packages like @dforge-core/dforge-mcp.
Detects hosts exhibiting multiple distinct file-manipulation commands (upload, download, stop, delete, append, copy, move) within a single session as identified by the PivotPipe C2 protocol, indicating potential staging, collection, or exfiltration activity.
Detects the execution of PowerShell with suspicious command-line arguments (hidden window, no profile, or encoded commands) spawned directly from a web browser process (e.g., Chrome, Edge, Firefox, Explorer). This behavior is characteristic of ClickFix-style social engineering attacks where a user is tricked into copying and executing malicious PowerShell commands via the Win+R Run dialog or terminal.
Detects unauthorized attempts to modify or patch the AmsiScanBuffer function within amsi.dll in a remote process. This behavior is indicative of an AMSI bypass attempt, a technique often used by malicious loaders and fileless malware to evade security product scanning.
Page 304 of 1168