Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Identifies network communication to known malicious infrastructure used by the SilkParasite threat actor. The rule specifically monitors DNS queries and destination connections to subdomains associated with 'hoster-kg.com' and 'tdtu.org', which are linked to the operation of SpiceRAT, NodeEdgeRAT, and NomadRAT malware.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects 32-bit PE files that are packed using UPX and utilize specific file names (1.exe or xeno.exe) associated with the SalatStealer credential harvester. The rule also checks for a zeroed compile timestamp in the PE header, which is a common characteristic of this malicious file.
Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.
This rule detects PowerShell commands that exhibit multi-stage suspicious behavior indicative of fileless malware execution. It monitors for combinations of cryptographic operations (AesManaged), decompression (GZipStream), and reflective assembly loading (System.Reflection.Assembly), which are common tactics used by attackers to decrypt, decompress, and execute malicious payloads directly in memory.
Detects the execution of wscript.exe spawning a child process of powershell.exe where the command line arguments are highly suspicious, including headless mode, encoded commands, and hidden window parameters. This pattern is commonly used by attackers to execute obfuscated malicious scripts while attempting to avoid detection.
This rule detects potentially malicious activity involving the patching of process memory or tampering with security instrumentation (such as Event Tracing for Windows - ETW) by common scripting host processes. It flags events like 'PatchProcessMemory', 'ProcessInjection', or references to 'AmsiScanBuffer' and 'EtwEventWrite' associated with PowerShell, WScript, or CScript, which are often used in post-exploitation scenarios to evade security controls and telemetry collection.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI) via direct memory modification or through script command-line arguments. The rule monitors DeviceEvents for AMSI-specific events (e.g., buffer patching, provider tampering) and looks for common PowerShell and scripting engine command-line patterns indicative of AMSI bypass techniques.
Detects high-frequency login attempts directed at the Dahua Easy4IP SDK port 37777, consistent with automated brute-force toolkits like async_brute.py. The rule monitors for a specific packet sequence indicating authentication attempts within a short timeframe.
Detects network traffic attempting to impersonate the Uzbekistan railway authority via suspicious TLS certificates. The rules identify specific SNI domains, certificate subjects, and issuers associated with the 'SilkParasite' campaign, which uses Chinese state-affiliated certificate authorities to facilitate C2 communications.
Page 422 of 1168