Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,293 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of a Windows service that impersonates the legitimate Windows Time (w32time) service name or display name but utilizes a binary located outside of the standard system32 directory. This behavior is indicative of a persistence mechanism, often used by backdoors like RemotePanel to evade detection after initial compromise.
Detects the execution of msiexec.exe where the process image is located in the user's local AppData directory under specific suspicious folder names. This behavior is indicative of a user-land installer or potential malware attempting to maintain persistence or execute malicious packages while masquerading as common applications.
Detects network traffic destined for api.telegram.org that follows the specific URL structure pattern associated with the CARBONATO Hermes Agent bot command-and-control channel.
Detects the creation of a scheduled task using schtasks.exe that involves 'keyroll' in the command line. This pattern specifically flags tasks associated with the 'rnpkeys.exe' utility or tasks being created within 'keyroll' directories, which may indicate the deployment or maintenance of unauthorized key management or persistence mechanisms.
Detects a sequence of events where a suspected sideloaded process (e.g., masquerading as common tools like curl or vim) is followed within 30 minutes by the registration of a new Windows service, a behavioral pattern associated with the NeedyMantis threat group.
Detects the execution of taskkill.exe to terminate known security software processes, when the command is initiated from sqlservr.exe or via a command shell child process of sqlservr.exe. This activity is a common post-exploitation step after abusing xp_cmdshell to neutralize defenses before deploying further payloads.
Detects the execution of the encryptbase64.ps1 PowerShell script when invoked by a process other than PowerShell or PowerShell Core. This behavior is indicative of NeedyMantis malware attempting to evade detection by executing scripts outside standard script hosts.
Detects network activity associated with the RatHat Android malware, specifically tracking device registration, log uploads to '/api/node/', and subsequent WebSocket protocol upgrades used for command-and-control communications.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects specific malicious archive payloads associated with NeedyMantis that contain a second-stage loader and spoofed system DLLs (e.g., dnsapi.dll, ws2_32.dll, msvcrt140.dll). These archives utilize XOR encoding or RtlDecompressBuffer packing and are designed for DLL sideloading.
Page 35 of 1168