Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
Detects instances where the AnyDesk remote support application initiates a Windows command shell (cmd.exe) or executes a batch (.bat) file. This behavior is often associated with remote access tools being used to execute arbitrary commands on a target system.
Detects the execution of signed, Microsoft-publisher binaries that are located in typically user-writable or suspicious directories (e.g., AppData, ProgramData, Temp, Users) when initiated by cmd.exe or powershell.exe with an argument indicating a batch file reference. This pattern is indicative of potential masquerading or living-off-the-land techniques where a signed binary is moved or executed from an unconventional location to bypass security controls or execution policies.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
This rule monitors for the installation of the 'indexed-btree' JavaScript package via common package managers (npm, yarn, pnpm) or its presence within a 'node_modules' directory. This specific package has been associated with supply chain attacks where malicious code is embedded within dependencies to compromise build systems or environments.
Detects a suspicious Node.js process pattern characterized by the execution of 'sharedLoad.min.js' or detached child processes, followed by rapid outbound network communication to known messaging platforms (Slack, Telegram). This behavior is indicative of the indexed-btree malware family, which exfiltrates host fingerprint data including architecture, hostname, and system metrics.
This rule detects the execution of the Xray proxy utility (xray-core) when launched by the RemoteApp workspace broker process (wkspbroker.exe) or located within the RemoteApp Gateway application data folder. This behavior is indicative of an adversary using proxy tools to facilitate command-and-control communication or network traffic tunneling via trusted remote access infrastructure.
Detects the creation of scheduled tasks initiated by the WinGet DSC configuration processes, specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is indicative of the abuse of the 'ScheduledTask' resource within a WinGet configuration file to establish persistence via a logon-triggered task.
This rule detects the presence of the malicious indexed-btree npm package by searching for its obfuscated runtime loader triggered via BTree.prototype.set. The malware attempts to spawn a detached Node.js process to execute a secondary payload (sharedLoad.min.js) instead of relying on standard installation scripts, allowing it to maintain persistence and bypass simple static analysis.
Detects the creation of a suspicious scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the execution of 'codeflush.exe' involving 'settingenv.cat'. These activities are associated with persistence and defense evasion techniques often used by malicious actors.
Page 314 of 1168