Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the unknown or suspicious process 'doxc' (or 'doxc.exe') executing common Windows system administration utilities ('wmic.exe', 'fsutil.exe', 'cmd.exe') or command-line arguments typically used for reconnaissance and system information discovery, such as listing logical disks or volume information.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
Detects common Windows command-line utilities used for internal network reconnaissance, including ARP cache queries, NetBIOS enumeration, SMB share/session discovery, and subnet ping sweeps. These techniques are frequently employed by adversaries for lateral movement preparation and internal network mapping.
Detects the use of PowerShell to enumerate storage devices (USB, disk, partition information) and perform file operations such as copying or logging, potentially indicating malicious data collection from removable media or external drives.
Detects execution of command lines containing suspicious, potentially obfuscated substrings that do not correspond to standard Windows utilities. The use of custom delimiters like 'ASISFH' within common command strings suggests an attempt to bypass signature-based detection.
Detects a scenario where a process (cmd.exe) executing a file named 'config.bat' subsequently launches another instance of cmd.exe to delete files with a '.lnk' extension. This behavior is indicative of cleanup activities after potential malicious script execution.
Page 384 of 1168