Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detection of known Cloudflare Workers subdomains used as dead-drop resolvers for C2 communication by the QUICSILVER QUICAgent malware. The rule monitors for specific DNS queries to resolve these domains and subsequent HTTP GET requests used to retrieve C2 instructions.
Detects instances where a process other than the legitimate Firefox browser executable loads the NSS (Network Security Services) libraries nss3.dll or mozglue.dll from the Firefox installation directory. This behavior is indicative of unauthorized attempts to decrypt saved browser credentials by interacting with Firefox-specific security modules, a technique commonly used by credential-stealing malware.
This rule detects the presence of the 'antiSNG' flag in command-line arguments of newly created processes. This flag is specific to the configuration of Hannibal Stealer, which uses it to perform anti-analysis checks, likely related to geofencing or environmental detection to evade sandbox or security analyst investigation.
Detects the creation of a shortcut (LNK) file within the Windows Startup directory that points to a msedge.exe binary located in a non-standard, masqueraded location within the user's Local AppData path. This behavior is associated with the LucidPawn/LucidRook persistence mechanism.
This rule detects instances where AutoIt (AutoIt3.exe) is observed performing process injection or launching suspicious binaries (RegSvcs.exe or mobsync.exe). Attackers frequently use AutoIt for process automation and to execute malicious payloads, and leveraging legitimate binaries like RegSvcs.exe is a known technique for bypassing defenses.
Detects the presence of a hardcoded X25519 public key associated with the 'indexed-btree' npm malware loader. This loader uses the key for ECDH key derivation to decrypt secondary payloads retrieved from an Ethereum smart contract, a technique used by malicious packages to hide their functionality.
Detects the execution of 'wkspbroker.exe' or the loading of 'radcui.dll' from a non-standard, user-writable directory path ('AppData\Local\Microsoft\RemoteApp\Gateway'). This behavior is indicative of DLL sideloading or execution of potentially malicious or unauthorized binaries masquerading as legitimate Windows remote connectivity components.
Detects the execution of AnyDesk shortly after a Microsoft Teams meeting or call initiation on the same host. This pattern is commonly observed in social engineering attacks where an adversary convinces a user to use remote access software during a live support or phishing call.
This rule detects potential social engineering attacks where an attacker initiates a Microsoft Teams call from an external domain while impersonating an internal IT support or help desk entity. The detection specifically correlates this event with a recent preceding email bombing campaign (exceeding 20 emails) targeting the same user within the last 3 hours, indicating a coordinated attempt to pressure or confuse the victim.
This rule detects potentially malicious activity where an executable with an MD5-formatted name is created in the user's temporary folder, followed by the creation of a registry key with a matching MD5-formatted name in HKEY_CURRENT_USER\SOFTWARE\ within 15 minutes. This behavior is indicative of a persistence mechanism where malware drops a payload in a temp directory and sets a run or autorun registry key to ensure its execution upon logon or startup.
Page 317 of 1168