Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,551 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of 'codeflush.exe' or attempts to rename files involving 'codeflush.exe' and 'pythonw.exe' within 'MusicLibrariesPackage' directories. This activity often indicates the execution of potentially malicious scripts or tools masquerading as legitimate software.
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects instances where an executable masquerading as 'msedge.exe' (Microsoft Edge) is launched from a user's Startup folder. The rule looks for files identified as 'msedge.exe' that contain metadata or product information associated with DISM (Deployment Image Servicing and Management) or base Windows operating system components, indicating a potential attempt to disguise a different utility or payload as a trusted web browser.
Detects the creation of scheduled tasks using schtasks.exe that are configured to repeat every minute, specifically targeting known malicious or suspicious filenames such as 'MicrosoftUserInterfacePicturesUpdateTackMachine', 'userscreen.exe', or 'config.cat'. The rule monitors both process creation command lines and registry modifications within the Windows Task Scheduler tree.
This rule detects suspicious directory creation or file attribute modifications within the 'naverwhale' roaming AppData directory. Adversaries may use this path to stage malicious payloads, persistence mechanisms, or to impersonate legitimate browser files.
Detects execution of potential Python-based backdoors or loaders that reference specific configuration files named 'config.cat' or 'AccountConfig.cat'. This behavior may indicate an adversary utilizing Python for command and control or malicious script execution.
Detects outbound network activity associated with the ChainScript malware family, including WebSocket C2 communication identified by a specific 'X-Agent-Token' header and TLS connections to known rotating command-and-control domains.
Detects the use of PowerShell command-line arguments designed to bypass or weaken execution policy restrictions. This includes setting the policy to 'Unrestricted' or 'Bypass' within a specific process scope, which is a common technique used by attackers to execute unsigned or malicious scripts.
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Detects the use of PowerShell commands that leverage Reflection.Assembly.Load, a common technique for loading .NET assemblies directly into memory. This behavior is often associated with fileless malware, reflective DLL injection, or obfuscated payloads attempting to bypass security controls like AMSI.
Page 391 of 1168