Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects attempts by a process (specifically targeting PowerShell or .NET loaders) to tamper with Windows Antimalware Scan Interface (AMSI) components in memory. It correlates EDR or Sysmon events (process access, module loads) targeting 'amsi.dll' or involving specific AMSI API strings like 'AmsiScanBuffer' or 'AmsiInitFailed' with potential malicious loader activity.
Detects a suspicious execution chain where WScript.exe initiates a process with '--headless' arguments, which in turn spawns a PowerShell process with hidden, encoded, and non-interactive command line flags. This pattern is commonly used by adversaries to execute malicious scripts while attempting to evade detection and user interaction.
Detects network traffic associated with exploitation attempts against Dahua P2P relay services. The rules monitor for specific URI patterns ('/online/p2psrv/' and '/probe/device/') used to probe the device, as well as traffic containing a hardcoded AES-OFB initialization vector, which indicates attempts to exploit CVE-2025-31702.
This rule detects PowerShell script blocks that exhibit multiple indicators of obfuscation and in-memory execution. It identifies the combination of AES encryption, embedded key bytes commonly associated with deobfuscation routines, GZip compression, and reflective assembly loading (Assembly.Load). The use of multiple techniques simultaneously significantly increases the likelihood of malicious activity, such as fileless malware loading or execution of obfuscated payloads.
Detects attempts to modify Windows Defender security settings by adding exclusions to the scan path using various PowerShell cmdlets or WMI methods. This behavior is often associated with adversaries attempting to evade detection by excluding malicious tools or directories from antivirus scanning.
Detects the execution of JavaScript files using wscript.exe from user-writable directories (e.g., Temp, Downloads, AppData) that exhibit high levels of obfuscation. The rule specifically flags scripts containing a high ratio of comment lines to code, a technique often used in the LausivLoader malware family to mask malicious payloads constructed using String.fromCharCode.
Detects the addition of a file path exclusion to Windows Defender via the command-line registry utility (reg.exe), followed immediately by the execution of gpupdate to force a policy refresh. This pattern is commonly used by adversaries to exclude malicious directories from security scanning and ensure the configuration change takes immediate effect.
Detects high-frequency TCP connection attempts to port 37777, commonly associated with Dahua surveillance devices. The rule uses a threshold of 200 connection attempts within 60 seconds from a single source, which is characteristic of mass-scanning or brute-force activity.
Detects network activity associated with the SilkParasite actor's NodeEdgeRAT malware, including DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to the identified command-and-control infrastructure 'hoster-kg.com'.
Detects attempts to disable Windows Defender Tamper Protection via direct Registry modification or by executing PowerShell commands. Disabling Tamper Protection is a common tactic used by adversaries to facilitate further malicious activity, such as impairing security controls or deleting malware artifacts without interference from Windows Defender.
Page 381 of 1168