Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of PowerShell or Command Prompt where the command line contains obfuscated indicators or specific suspicious files and IP addresses, while simultaneously bypassing the execution policy. This is characteristic of malicious script execution or payload delivery attempts.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects execution of PowerShell or CMD commands originating from Windows Explorer (explorer.exe) that exhibit characteristics of malicious command-line obfuscation, such as encoded commands, bypass flags, or caret-based character obfuscation.
Detects the use of .NET reflection and assembly loading techniques within PowerShell or C# compiler (csc.exe) command lines. Attackers frequently use these methods to load malicious payloads directly into memory, bypassing disk-based detection mechanisms. The rule looks for the combination of reflection-related namespaces/methods and indicators of obfuscation or encoding such as Base64 strings, Gzip compression, and decryption routines.
Detects instances where PowerShell initiates process injection behaviors, specifically targeting common user-facing applications such as browsers (chrome.exe, msedge.exe), build tools (csc.exe), or indexing services (SearchIndexer.exe). The rule identifies memory allocation and thread manipulation activities often associated with reflective code injection or memory-based payloads.
Detects the installation or service creation of 'gdrv.sys', a known vulnerable GIGABYTE driver often abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to escalate privileges.
Detects the execution of ReAgentC.exe with the /disable flag, which disables the Windows Recovery Environment (WinRE). This activity is often used by adversaries to prevent system recovery or to facilitate data impact, such as ransomware deployment.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects Remote Desktop Protocol (RDP) traffic occurring over non-standard high ports (64350, 64330, 65535, 65111, 61256), which is indicative of SilkParasite C2 activity or potentially malicious lateral movement attempting to bypass standard port monitoring.
Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.
Page 378 of 1168