Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,549 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors all process creation events on macOS endpoints. By tracking both 'ProcessCreate' and 'ProcessRollup2' event types where the platform is identified as macOS, it provides a foundation for auditing execution activity across the system.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
Detects a pattern of frequent (6 or more per minute) small HTTP POST requests (up to 16KB) targeting specific sensitive API or internal URI paths. The detection logic also filters for traffic originating from a specific Microsoft Edge browser user agent string on Windows 64-bit systems, which may indicate automated data exfiltration, beaconing, or communication with a Command and Control (C2) server.
Detects the execution of rnpkeys.exe dropped by an MSI installer (msiexec.exe) from the C:\ProgramData\keyroll directory. The rule specifically monitors for side-loading of the rnp.dll or tdwp.dll libraries by rnpkeys.exe, a technique associated with the Sauron loader.
Detects anomalous network traffic patterns from the legitimate 'rnpkeys.exe' process when side-loaded from the 'ProgramData\keyroll' directory. The rule specifically looks for a sequence of connections matching initial C2 registration (TLV 0x01) followed by consistent, periodic beaconing (TLV 0x02) at an interval indicating automated task polling, rather than single-connection legitimate activity.
This rule detects the creation of Windows Scheduled Tasks by monitoring for Event ID 4698 (Windows Security Log) or Sysmon Event ID 1 (Process Creation) that involves task name parameters. Adversaries frequently use the Windows Task Scheduler to establish persistence, execute malicious code, or run tasks at system startup.
This rule monitors the rnpkeys.exe process for suspicious environmental reconnaissance activity, specifically targeting locale/keyboard-layout registry queries or domain enumeration via command-line tools. These activities are identified as occurring in a strict temporal sequence (pre-registration check) shortly before an initial outbound network connection, consistent with the behavior of the Sauron loader malware.
Page 371 of 1168