Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
This rule detects modifications to Microsoft Defender antivirus exclusions. Adversaries often add paths or files to the exclusion list to prevent the detection of malicious tools or staging folders during cyberattacks. The rule monitors both command-line execution of PowerShell (Add-MpPreference/Set-MpPreference) and direct registry modifications related to Windows Defender paths.
Detects the HEAVYGRAM second-stage implants 'RuntimeSSH.exe' or 'winappx.exe' establishing persistence by adding entries to Windows Registry Run or RunOnce keys.
Detects execution of potential MovieReaper loader components by monitoring for the creation of a specific, statically defined global mutex or patterns indicative of dynamic mutex naming conventions often used to ensure single-instance execution by malware.
Detects successful authentication events using the OAuth 2.0 device code flow. While a legitimate authentication method for devices without web browsers, this protocol is frequently abused by attackers in 'device code phishing' attacks to harvest access tokens and gain unauthorized access to cloud and SaaS applications.
Detects the use of PowerShell with the EncodedCommand parameter to modify or create entries in the HKEY_CURRENT_USER Run registry keys, a technique used by the HEAVYGRAM malware for persistence.
Detects the use of the Add-MpPreference cmdlet with -ExclusionPath, or processes spawned by CRUDEEXCLUDE.exe, which are associated with configuring Microsoft Defender exclusion paths. This is often used by adversaries to evade detection by excluding malicious files or directories from antivirus scanning.
This rule detects instances where Windows scripting engines (WScript or MSHTA) execute script files (WSF, VBS, HTA) which subsequently spawn a PowerShell process using encoded command arguments. This pattern is commonly used by adversaries to mask malicious payloads and bypass execution policy or simple command-line monitoring.
Detects anomalous process activity associated with the RatHat Android malware, specifically the execution of 'liblocal-service.so' as a daemon and its use for silent APK reinstallation or monitoring of package paths (via 'pm' commands).
Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.
Page 415 of 1168