Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation or unauthorized usage of the 'p2pwn' backdoor account and associated 'p2password' credentials on Dahua devices. This indicator is linked to exploitation of CVE-2024-39943, which allows for persistent unauthorized access that survives device factory resets.
This rule detects two potentially malicious activities: the addition of exclusions to Windows Defender using reg.exe, which can be used to hide malicious files from security scanning, and the forceful update of Group Policy using gpupdate.exe with /force and /wait:0, which can be used to propagate malicious policy changes or force re-application of settings.
Detects network packets targeting the Dahua SDK service (port 37777) that match the signature of a crafted login request, specifically checking for the 0xFF/0x00 magic header and the 0x00/0xA0 opcode. This pattern is commonly associated with unauthorized authentication attempts, including brute-force attacks or exploitation of known authentication bypass vulnerabilities in Dahua devices.
Detects network traffic and DNS queries associated with the SilkParasite command-and-control (C2) infrastructure. This rule monitors for established RDP-over-TLS connections using non-standard, high-numbered ports and identifies associated DNS lookups for known C2 hostnames.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects the creation, renaming, or modification of a file named 'FitnessMonitor.exe' within the Windows Startup folder. This behavior is indicative of an attempt to establish persistence by ensuring the executable runs automatically upon user login.
Detects the addition of a 'DailyFitnessTracker' registry entry into the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' key. This is a common persistence technique where programs are configured to execute automatically upon user login, utilizing either 'reg.exe' or PowerShell 'New-ItemProperty' to modify the registry.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
Detects the execution of command-line tools (cmd.exe or wscript.exe) spawned by Windows Explorer (explorer.exe) where the command line contains references to .lnk files or specific batch filenames (doxc.bat, config.bat). This behavior is often indicative of malicious shortcut files used to trigger secondary stage payloads.
This rule detects the execution of processes where the command line contains suspicious obfuscated substrings. These substrings, which include segments like 'inASISFHfo', 'geASISFHutarvs', 'scASISFHuren', 'fiASISFHu_lsz', 'afASISFHile', or 'ruASISFHunf', are characteristic of command-line obfuscation techniques designed to bypass security monitoring by concealing the true intent of the command.
Page 383 of 1168