Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the legacy 'finger.exe' network utility with suspicious command-line arguments. The finger protocol is an outdated service that provides information about users on a system; adversaries may abuse this utility to perform network reconnaissance, identify user accounts, or gather system-level information.
Detects the execution of network utilities like finger.exe or curl.exe (with download parameters) initiated by a command shell (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used by adversaries for reconnaissance or downloading malicious payloads.
Detects when a high volume of distinct security-related processes or services are terminated on a single host within a 2-minute window. This behavior is strongly indicative of an adversary attempting to disable endpoint protection software as part of a post-compromise defensive evasion effort.
Detects access to sensitive files (KeePass databases, SSH private keys, and VPN configurations) by processes other than their designated applications. This behavior indicates potential credential harvesting or configuration exfiltration by unauthorized processes.
Detects execution of python scripts or shell commands involving curl from temporary directories like /tmp, /Temp, or /Downloads. This pattern is commonly associated with the staging and execution of malicious payloads, often involving downloading scripts via curl or executing files that mimic legitimate standalone python builds or system scripts.
This rule monitors for the loading or interaction with specific device drivers named 'truesight.sys' or 'rentdrv2.sys'. These drivers are often associated with malicious activity, including potentially vulnerable kernel drivers used in BYOVD (Bring Your Own Vulnerable Driver) attacks or rootkit-like persistence mechanisms. The rule tracks driver loading, registry updates, process activity, and device I/O control calls related to these files.
Detects anomalous sequential SMB scanning patterns across a /24 subnet and subsequent SMB share enumeration attempts (NetShareEnum) from a single host, consistent with reconnaissance activities associated with the DragonForce threat actor group.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects high volumes of file creations, modifications, or renames ending with a specific encrypted file extension (.df_win) occurring across multiple network (SMB) shares from a single host within a short timeframe. This behavior is indicative of ransomware activity where a compromised host attempts to encrypt files on accessible remote storage.
Detects attempts to delete Volume Shadow Copies using native Windows administrative tools such as wmic.exe and vssadmin.exe. This activity is frequently associated with ransomware, as adversaries often delete local backups to prevent data recovery.
Page 417 of 1168