Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,560 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of netscan.exe, a common network scanning tool often used by adversaries to enumerate network resources, hosts, and services within a compromised environment.
Detects DragonForce ransomware behavior where the binary is copied to a staging directory (typically C:\Users\Public\) and subsequently registered as a persistent, one-time execution scheduled task with SYSTEM privileges using COM interfaces or schtasks.exe.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'safeboot' mode with networking enabled. Adversaries may use this to bypass security controls that only run in normal boot mode or to facilitate persistent access with minimal system interference.
Detects successful VPN authentication events targeting SonicWall devices during non-business hours (between 20:00 and 06:00, or on weekends). This behavior is characteristic of initial access tradecraft often employed by ransomware affiliates to gain network entry with minimal operational noise.
This rule detects attempts to patch critical Windows functions used for security instrumentation, specifically 'AmsiScanBuffer' within 'amsi.dll' (often for bypassing AMSI) or 'EtwEventWrite' within 'ntdll.dll' (often for disabling ETW logging). This activity is highly indicative of defensive evasion techniques used by malware or malicious actors to hide their behavior from security tools.
Detects memory regions associated with 'ntdll.dll' that are marked with Read, Write, and Execute (RWX) permissions. This pattern is commonly used in process injection techniques, such as reflective DLL injection or shellcode execution, where adversaries prepare executable memory space within a legitimate process to bypass standard security controls.
Detects instances where a process has been elevated on a Windows system, as indicated by specific log messages containing 'Process is elevated' within the command line or image file name fields.
Detects the use of bcdedit.exe to modify the boot configuration to enable Safe Mode with Networking. This is often used by adversaries to bypass security controls or to prepare a system for activities while in a state where many security products may not load or function.
Detects rapid, bulk process termination of critical system, security, database, and office applications using the Windows taskkill.exe utility. This behavior is characteristic of ransomware (such as DragonForce) attempting to release file locks prior to initiating encryption activities.
Detects processes executed with specific command line arguments often associated with malicious tools or malware, such as mutex bypass flags, logging configuration, or arbitrary size parameters that are not related to help or usage documentation.
Page 449 of 1168