Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,548 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound SMTP communication to Gmail servers containing specific indicators of compromise (sender, recipient, or subject line) associated with the LucidKnight (LucidRook) malware campaign, indicating potential reconnaissance data exfiltration.
Detects network beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. The rule monitors for specific C2 communication patterns, including the 'client;' string and the 'VVx-4.3' version marker, which are characteristic of this malware's host reconnaissance and command-and-control exfiltration phase.
This rule detects potentially malicious activity where an executable with an MD5-formatted name is created in the user's temporary folder, followed by the creation of a registry key with a matching MD5-formatted name in HKEY_CURRENT_USER\SOFTWARE\ within 15 minutes. This behavior is indicative of a persistence mechanism where malware drops a payload in a temp directory and sets a run or autorun registry key to ensure its execution upon logon or startup.
This rule detects the execution of common command-line utilities (cmd.exe, mshta.exe, AutoIt3.exe) using command-line arguments that mimic legitimate service names or security analysis tools (e.g., 'Microsoft Update Superfetch Core Endpoint Service'). This behavior is indicative of an adversary attempting to mask malicious activity by using strings that resemble benign system services or localized security scanner output, likely for obfuscation or evasion.
Detects execution of common administrative and potentially malicious processes originating from the Microsoft Exchange Server worker process (w3wp.exe). This pattern is indicative of a web shell or post-exploitation activity where an attacker has achieved code execution on an Exchange server.
Detects a variant of the ClickFix technique where an attacker directs a user to open an administrative PowerShell or Command Prompt instance via the Windows+X power user menu through Windows Terminal. This execution chain, involving WindowsTerminal.exe, OpenConsole.exe, and a shell binary, bypasses traditional RunMRU registry artifacts often associated with the standard Windows Run dialog.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects the presence of PureLogs Stealer, a .NET-based information stealer, by identifying specific family name strings embedded within PE files that conform to the .NET assembly structure. This rule targets the static analysis of malicious binaries often used in credential harvesting campaigns.
Detects PowerShell scripts attempting to evade detection through programmatic runtime creation using Runspaces (RunspaceFactory, CreatePipeline, AddScript) combined with cryptographic operations or dynamic string substitution techniques. This behavior is often associated with obfuscated malware payloads attempting to execute code in memory.
Page 367 of 1168