Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,549 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of rnpkeys.exe from the path C:\ProgramData\keyroll\, which performs DLL side-loading by loading rnp.dll followed by tdwp.dll. This sequence is indicative of the Sauron Loader malware attempting to perform in-memory payload decryption.
Detects the Sauron Loader malware pattern where a payload is downloaded or retrieved and written to a randomly named file within a temporary directory, followed by the immediate execution of that staged file. This behavior is indicative of C2 tasking involving payload staging.
Detects the execution of staged scripts (.cmd, .ps1, .vbs, .js) from user temporary directories using cmd.exe, powershell.exe, or wscript.exe. This behavior is consistent with the Sauron Loader malware family, which utilizes these interpreters to execute secondary C2-tasked payloads.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects instances of process injection targeting the 'attrib.exe' process. This behavior is associated with the Sauron Loader, which performs in-memory shellcode execution by allocating memory and creating a remote thread within a legitimate process, such as 'attrib.exe', to avoid writing payloads to disk.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 registration/heartbeat beacons and tasking retrieval requests to known C2 URI paths over port 8133.
Detects network activity associated with the Sauron Loader, including TLS connections to specific C2 domains and repeated HTTPS POST requests to api.* subdomains indicating beaconing or polling behavior.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches known command-and-control (C2) domains associated with the Sauron Loader malware. This indicates a compromised host attempting to communicate with malicious infrastructure.
Page 373 of 1168