Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,543 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.
This rule detects the creation or modification of Windows Registry Run keys, which are a common technique used for achieving persistence. The rule specifically monitors for known suspicious or potentially malicious file names (e.g., RuntimeSSH.exe, MicDriver.exe, winappx.exe, MsCache.exe, smqdservice.exe) being added to Run locations, which triggers automatic execution upon user logon.
Detects Microsoft Edge executable (msedge.exe) being created, deleted, or renamed within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This path is often used by adversaries to masquerade malicious files or persistence mechanisms as legitimate telemetry components.
This rule detects unauthorized processes attempting to access 'Login Data' files associated with Google Chrome or Microsoft Edge web browsers. Legitimate browser processes are excluded, so any external process attempting to read these files is potentially malicious, indicating an attempt to dump stored browser credentials.
This rule detects the execution of cmd.exe with a command line containing both '/k' and 'Set' commands, alongside a regex pattern that searches for specific variable expansion techniques ('%var:~offset,length%'). This pattern is frequently used to obfuscate command lines or bypass static security signatures by reconstructing strings at runtime, often in conjunction with PowerShell commands.
This rule monitors for the creation of files with the .ent extension within the Microsoft Internet Explorer directory. The rule specifically looks for files with a six-character alphanumeric name (e.g., abc123.ent), which may indicate the use of custom scripts, configuration files, or data staging by potentially malicious actors leveraging the browser's directory structure for persistence or data storage.
Detects instances where a GitLab runner process (gitlab-runner.exe) spawns a PowerShell process with arguments typically used to execute scripts while bypassing security restrictions, such as -NoProfile, -NonInteractive, -ExecutionPolicy, and Bypass. This pattern is indicative of automated task execution or potential abuse if the runner environment is compromised.
This rule detects the execution of specific suspicious batch scripts (e.g., 'bd_test_k7old.bat') via cmd.exe, or the creation of a Windows service involving kernel drivers using sc.exe, which may indicate testing of defensive mechanisms or the deployment of potentially malicious kernel-level components.
Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.
Detects instances where the Cursor IDE (or associated helper processes) spawns a child process or executes a command involving a specific 'DevOps-Automation/cloudshield' path. This monitors for potential abuse of IDE environments to trigger sensitive automation scripts, possibly indicating malicious use of IDE tooling or unauthorized development activities.
Page 342 of 1168