Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects network traffic originating from the RatHat Android malware, specifically identifying the 'SCROLL_DOWN' command in HTTP response bodies. This suggests the malware is receiving instructions from a C2 server to perform UI automation or interaction tasks.
Detects instances where web server or application-related processes (pc-app, java, pc-tomcat, PCClient) spawn command shell interpreters (cmd, powershell, pwsh). This behavior is often indicative of exploitation of a web application vulnerability, such as remote code execution.
This rule detects attempts by AutoIt scripts (running as AutoIt3.exe or from Temp directories) to perform process injection into the Windows Character Map utility (charmap.exe). It monitors for suspicious API calls like OpenProcess, CreateRemoteThread, and VirtualAllocEx, specifically looking for memory access and protection flags commonly used during malicious process injection.
This rule detects the creation or modification of registry keys within the RunOnce path in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. These keys are commonly abused by adversaries to achieve persistence, as programs referenced in them execute automatically upon the next user logon or system start.
This rule detects the creation of a synchronization mutex with a specific naming pattern ('Global\EVOLUTION') often used by malware families to ensure only a single instance of the malicious process runs on the infected host. The rule monitors DeviceEvents for 'MutexCreated' or 'MutexEvent' and parses the synchronization object name to identify this specific indicator.
Detects instances where Outlook (OUTLOOK.EXE) spawns an executable named 'ai.exe' with a command line containing a 16+ character hexadecimal string, followed closely (within 10 minutes) by a Microsoft Edge (msedge.exe) process execution acting as a network utility. This pattern is indicative of a potential phishing-initiated attack where a malicious payload is executed and subsequently leverages browser components for network communication or C2 activity.
Detects the execution of ConfigurationRemotingServer.exe initiated by winget.exe. This could indicate usage of the Windows Package Manager to facilitate remote configuration or management tasks, which warrants investigation for potential unauthorized use or process manipulation.
This rule detects instances of MSBuild.exe executing or communicating over the network while referencing .NET Framework paths. MSBuild is often abused as a LOLBAS (Living Off the Land Binary and Script) to execute arbitrary code or bypass application control, and unusual network activity from this process is a common indicator of beaconing or command-and-control communication.
This rule detects the use of 'winget' or 'ConfigurationRemotingServer.exe' to execute Windows Configuration DSC (Desired State Configuration) files, specifically targeting the invocation of 'PSDscResources/Script' resources, 'SetScript', 'TestScript', or 'GetScript' operations. This technique may be leveraged by attackers to execute arbitrary code or maintain persistence through the configuration management framework.
Detects successful network connections initiated by the ConfigurationRemotingServer.exe process. This binary is associated with Windows configuration remoting services and may be used for remote administrative tasks or unauthorized remote management activities.
Page 389 of 1168