Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,549 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of native system utilities including wmic, vssadmin, and wbadmin to delete Volume Shadow Copies or the Backup Catalog, as well as the deletion of local snapshots on macOS via tmutil. These actions are common techniques employed by ransomware to prevent system restoration after encryption.
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
Detects the execution of rundll32.exe with command-line arguments that include references to 'WindowsUpdate.log' and a specific ordinal or function index. This pattern is commonly associated with attempts to leverage rundll32.exe to execute arbitrary code while masquerading as legitimate Windows update operations.
Detects the execution of PowerShell with hidden window style and long Base64 or encoded command strings, which is a common technique used by attackers to execute obfuscated malicious scripts while minimizing visibility on the endpoint.
Detects modifications to registry keys associated with the 'ms-settings' COM object, specifically targeting the shell open command or DelegateExecute value. This technique, commonly referred to as 'ms-settings' hijacking, is used by adversaries to achieve persistence or elevated execution by redirecting legitimate COM object references to malicious payloads.
Detects when three or more critical security, database, or service processes are terminated on a Windows host within a short timeframe. This behavior is often indicative of an adversary attempting to disable security monitoring (e.g., Windows Defender/MsMpEng.exe) or perform disruptive activity against critical infrastructure (e.g., SQL Server processes).
This rule detects the use of PowerShell to download common Remote Monitoring and Management (RMM) or remote access tools from the internet. This behavior is frequently associated with malicious actors attempting to establish persistent remote access to a compromised system.
Detects the use of the net.exe or net1.exe utility to add a local user account with the specific password string 'Numlock!123'. This pattern is frequently used by attackers or malicious scripts to establish persistence or secondary access on a system.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects HTTP POST requests targeting the '/api/credentials' path on non-standard port 8133, which is indicative of AMOS (Atomic macOS Stealer) malware exfiltrating stolen credentials to a remote command and control server.
Page 369 of 1168