Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects the use of PowerShell command lines containing both 'AesManaged' for decryption and '[System.Reflection.Assembly]::Load' for reflective loading of a .NET assembly in memory. This pattern is consistent with the execution stage of malware such as LausivLoader, which stage encrypted payloads and load them directly into the process memory to evade disk-based detection.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdateTaskCore' that is configured to execute a malicious JavaScript file named 'PhotoStudio.js' using wscript.exe with silent flags. This behavior is indicative of persistence mechanisms employed by the LausivLoader malware family.
This rule monitors for DNS queries and TLS certificate attributes associated with the SilkParasite threat actor. The rule specifically targets domains that impersonate Central Asian government entities and monitors for suspicious TLS certificate issuers and subjects, indicating potential C2 infrastructure or phishing activity.
Detects network communication associated with the SilkParasite campaign. This includes detection of TLS traffic using self-signed LokiDev certificates (CN=localhost, O=LokiDev), direct connections to known malicious C2 IP addresses, and DNS queries for the domain normativ.dushanbeidc.org, which is linked to the LokiDev infrastructure.
Detects network traffic involving TLS certificates that impersonate the Uzbekistan state railway authority, specifically using certificates issued by 'TLC DV TLS CA' or specific known malicious certificate fingerprints. This activity is attributed to the threat actor SilkParasite.
Detects the execution of DahuaConsole processes that are spawned by or associated with the scannerdahua utility. This pattern is often associated with discovery or exploitation activities targeting Dahua devices.
This rule detects suspicious activity related to specific hardcoded indicators 'p2pwn', 'p2password', and references to 'cve-2024-39943'. It scans authentication logs (Identity) and EDR logs (process command lines) for these terms, flagging potential unauthorized access, credential use, or exploitation attempts associated with this specific threat activity.
Detects the creation or execution of scheduled tasks named 'MicrosoftEdgeUpdateTaskCore' that exhibit suspicious behaviors, specifically those marked as hidden, tasks utilizing a LogonTrigger, or tasks executing wscript.exe with specific command-line arguments (e.g., //B, //Nologo) often associated with malicious script execution patterns.
Page 380 of 1168