Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,557 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential information stealer activity by identifying the staging of files (.html, .txt, .log) in common user directories like AppData or Temp, combined with process command lines querying sensitive system information (e.g., BIOS, wallets, screen resolution) and network connections to the Telegram API for likely exfiltration.
This rule detects the execution of specific suspicious binary names (TempuARKK20.exe, uARKK20.exe) from within temporary directories or their association with command-line arguments involving 'curl.exe' or specific suspicious web hosting strings. This behavior is indicative of malware staging and downloading secondary payloads in an attempt to masquerade as legitimate utilities.
This rule detects various suspicious activities associated with file staging and execution in the C:\Users\Public directory, including the handling of suspicious ZIP archives, renaming of executables (pythonw.exe to userscreen.exe), and the execution of specific batch scripts or obfuscated commands. These behaviors are indicative of an adversary staging tools or persistence mechanisms on a compromised system.
Detects the deletion of the Windows Application Event Log registry key. This action is a known technique used by adversaries to disable or tamper with event logging mechanisms to conceal malicious activity.
Detects the use of PowerShell to download the 'gitlab-runner-windows-amd64.exe' binary, potentially indicating unauthorized installation or deployment of automation agents using legitimate download sources.
This rule detects potentially malicious activity related to the installation or misconfiguration of GitLab runner executables. It looks for unusual service creation, direct execution of runner binaries from temporary locations (e.g., C:\Windows\Temp), and the presence of configuration files or PowerShell scripts in unexpected directories that might indicate persistent access or unauthorized setup of a build runner.
Detects the installation of a GitLab Runner service on Windows, specifically identifying cases where the service is configured to run under the LocalSystem account. This is monitored via Service Control Manager (Event ID 7045), Sysmon (Registry Event ID 13), and process creation events involving sc.exe or gitlab-runner.exe.
This rule detects instances where common system utilities like notepad.exe or calc.exe are spawned as child processes by PowerShell.exe, specifically when the initiating PowerShell process was spawned by gitlab-runner.exe but the parent process information no longer resolves correctly. This is often indicative of persistence or post-exploitation activities occurring after a CI/CD job has ostensibly finished.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
Detects the sequential execution of multiple Microsoft-signed LOLBins (Living Off the Land Binaries) spawned by the same parent process (PowerShell or CMD) within a 5-minute window. This behavior is indicative of a cascading fallback mechanism used by post-exploitation tools to bypass application allowlisting or security controls.
Page 448 of 1168