Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,557 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the abuse of the legitimate Windows script 'SyncAppvPublishingServer.vbs' to proxy the execution of malicious commands, specifically by appending an arbitrary command separated by a semicolon.
Detects the execution of the Program Compatibility Assistant (pcalua.exe) with the '-a' flag to launch executables located in common user-writable directories such as Temp, Downloads, or AppData. This behavior is a known Living off the Land Binaries and Scripts (LOLBAS) technique used to proxy execution and potentially bypass security controls or break parent-child process lineage.
Detects the use of command-line utilities (cmd.exe, curl.exe, tar.exe) to download or interact with specific suspicious zip archives (python-3.10.0-embed-amd64.zip, temp012.zip, MusicLibrariesPackage) from known staging directories or external sources often associated with malicious staging or persistence.
Detects the execution of wscript.exe or cscript.exe with VBScript or JScript files from user-writable and temporary directories, such as %TEMP%, %APPDATA%, and Downloads folders. This pattern is commonly associated with the execution of malicious droppers and loaders in malspam campaigns.
Detects the execution of cmd.exe with suspicious command-line obfuscation patterns. The rule looks for the use of the '/k' flag combined with variable assignment and character substitution/expansion patterns (e.g., %var:~start,len%), often used in batch file obfuscation to execute malicious logic. It specifically triggers when originating from common suspicious parents like explorer.exe or Bandizip.exe, or when targeting syswow64 locations.
This rule detects potentially malicious command execution initiated by or linked to the Bandizip archive utility. It identifies scenarios where Bandizip launches shells (cmd, powershell, wscript, cscript) to execute scripts or commands (e.g., .lnk files, .bat, .vbs, .js, .ps1), or where suspicious 'cmd.exe /k' commands are executed directly or through an updater process.
Detects the use of odbcconf.exe with the REGSVR flag to load DLLs from suspicious directory locations (such as Temp, Downloads, or AppData), a technique used by adversaries to proxy execution and bypass application control.
Detects the execution of installutil.exe with specific command-line arguments (logging disabled, uninstall flag) from file paths outside of the standard .NET directory structure. This pattern is commonly used by attackers to proxy execution of arbitrary managed code, effectively bypassing application whitelisting and security controls.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects file creation, renaming, or deletion events within the Recycle Bin directory involving suspicious filenames or PDF files, which may indicate an adversary attempting to hide, stage, or delete evidence.
Page 445 of 1168