Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,547 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-risk IAM policy modifications, specifically the attachment or creation of policies that grant wildcard permissions or full administrator access. The rule optionally correlates these permission changes with the recent creation of access keys or service account credentials for the same principal, indicating potential preparation for persistence or unauthorized access escalation.
This rule detects potential ransomware activity by correlating the execution of native Windows utilities used to inhibit system recovery (vssadmin, wmic, wbadmin, bcdedit) followed by a high volume of file modification events on the same host within a 15-minute window.
Detects two distinct methods of living-off-the-land proxy execution: first, MSBuild.exe spawning network connections after executing inline tasks defined in XML project files; second, Regsvr32.exe performing 'Squiblydoo' execution by loading COM scriptlets from remote URLs.
Detects command-line execution patterns indicative of Anti-Malware Scan Interface (AMSI) bypass attempts. The rule looks for attempts to manipulate internal .NET AmsiUtils fields, modify AmsiScanBuffer, or utilize VirtualProtect against amsi.dll memory regions, all of which are common techniques employed by malicious loaders to evade script-based detection.
Detects Kerberos service ticket requests (Event ID 4769) that utilize weak RC4 encryption (0x17). This behavior is characteristic of Kerberoasting, where attackers request service tickets for service accounts in order to perform offline brute-force attacks to recover the service account password. The rule filters out machine account requests and focuses on standard user or service account requests.
Detects suspicious PowerShell execution patterns involving encoded commands, hidden window styles, or common download cradles combined with code obfuscation techniques. This rule monitors PowerShell ScriptBlock Logging (Event ID 4104) for combinations of indicators often used by threat actors to evade detection, such as Base64-encoded strings, hidden execution flags, network download utilities, and script obfuscation techniques.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable recovery mechanisms. This behavior is commonly associated with ransomware or destructive attacks attempting to inhibit system recovery.
This rule detects attempts to perform a DCSync attack by monitoring for Windows Event ID 4662 (Object Access) with specific Directory Replication Service (DRS) GUIDs. These GUIDs are used by attackers to request the replication of sensitive data, such as password hashes, from a Domain Controller without having direct access to it. This technique is commonly used by tools like Mimikatz and Impacket's secretsdump to extract credentials from Active Directory.
This rule detects the creation of named pipes with names that match default or commonly customized patterns used by Cobalt Strike Beacons for inter-process communication (IPC) and lateral movement. The detection specifically targets common pipe naming conventions such as those starting with 'msagent_', 'MSSE-', 'postex_', 'status_', and 'mypipe-', which are frequently observed in Cobalt Strike configurations.
Detects the creation of new system services using EventID 7045 where the ImagePath points to suspicious temporary directories, administrative shares (ADMIN$), or utilizes randomly generated service names. This pattern is commonly associated with PsExec-style lateral movement and ransomware staging.
Page 357 of 1168