Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,547 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of certutil.exe to add a certificate to the root store. Adversaries may perform this action to establish persistence or facilitate interception of encrypted traffic by adding a malicious CA certificate to the trusted root store.
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
Detects the PUROSANGUE malware loader, which achieves execution by being sideloaded as 'vsdbg.dll' alongside a legitimate debugger executable. The detection leverages YARA rules focusing on specific artifacts such as a hardcoded build path, a custom Base16 alphabet, and a structural anomaly in the PE file's .reloc section compared to the declared base relocation directory size, alongside known malicious hash values.
Detects the modification of Windows Registry Run keys that point to suspicious executable paths or known naming patterns associated with specific services (SMQDService and winappx) often utilized for persistence.
Detects the creation or modification of registry entries within the 'HKCU\...\Run' hive that point to executables located in suspicious or atypical directories such as 'ProgramData', 'Users\All Users', or specific non-standard application paths often used by malware for persistence.
Detects the execution of binaries masquerading as legitimate software (such as KeePass, Adobe Flash, or specialized medical document viewers) from user-writable and non-standard execution paths (e.g., Downloads, Temp). This behavior is characteristic of the CHOSEN BRICK malware's lure-execution stage, where users are socially engineered into running a decoy installer.
Detects the use of built-in Windows utilities and commands to disable system recovery features, delete volume shadow copies, clear backup catalogs, or perform mass file deletion. This behavior is highly indicative of wiper malware preparing for a destructive attack by preventing system recovery.
Detects outbound network traffic, including DNS lookups, TLS connections, and HTTP requests, directed towards IPRoyal or LightningProxies. These services are commonly used as residential or datacenter proxies and may be leveraged by adversaries for command-and-control (C2) communication, including traffic tunneling for services like Telegram.
Flags individual authentication events against services WaterPlum/North Korean IT worker operations are known to touch (laptop-farm remote-access tooling, freelance/crowdsourcing platforms, job-application and recruitment portals). This rule matches on a SINGLE qualifying event and does not itself prove IP reuse across contexts -- this Sigma dialect has no native cross-event correlation construct, so confirming that the SAME source IP appears across two or more of these categories (the actual WaterPlum indicator reported by investigators) requires a downstream correlation search, SOAR playbook, or UEBA rule that groups these flagged events by SourceIp over a rolling window.
Page 362 of 1168