Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,557 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-frequency connection attempts to TCP port 445 within the internal network or across RFC1918 subnets, indicating potential reconnaissance activity such as SMB share scanning commonly associated with lateral movement or network mapping.
Detection rules designed to identify communication patterns associated with the CRPx0 ransomware, specifically targeting HTTP-based command-and-control (C2) traffic, including relay server interaction, unique Authorization headers, and connections to known onion-based proxies.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'Safe Mode with Networking'. This behavior is commonly observed as an evasion technique used by threat actors, including Akira ransomware affiliates, to bypass EDR protections during pre-ransomware staging activities.
Detects potential abuse of rundll32.exe to execute commands or functions, particularly those involving references to 'WindowsUpdate.log' or direct execution with ordinal identifiers ('#1'). This rule also monitors file operations involving 'WindowsUpdate.log' initiated by common script interpreters like powershell.exe, cmd.exe, or rundll32.exe, which is often associated with obfuscated techniques to execute malicious payloads or bypass security controls.
Detects unauthorized in-memory memory modifications (specifically writing to memory segments with execute permissions) targeting critical security functions within 'amsi.dll' or 'ntdll.dll', such as 'AmsiScanBuffer' or 'EtwEventWrite'. This activity is characteristic of AMSI/ETW blinding, a technique used by threat actors to disable endpoint security scanning and event tracing capabilities.
This rule detects the use of 'taskkill.exe' to terminate critical services, including security software (MsMpEng.exe), database processes (sql.exe, oracle.exe, sqlservr.exe), and common user applications (outlook.exe, onedrive.exe). This behavior is characteristic of the DragonForce ransomware, which disables protective services and applications before encryption to minimize interference and ensure successful file locking.
Detects high volumes of file rename operations within a short timeframe, which is a behavioral indicator often associated with the encryption process of ransomware such as CRPx0.
Detects the CRPx0 ransomware technique of unhooking ntdll.dll in memory. This is achieved by reading the ntdll.dll file from disk and overwriting the in-memory .text section with a clean, unhooked version to bypass EDR monitoring and execute direct syscalls.
Detects the execution of SoftPerfect Network Scanner (netscan.exe), a tool frequently utilized by threat actors such as Ransom Busters for internal network reconnaissance and host discovery activities prior to lateral movement or data exfiltration.
Detects the modification of boot configuration data (BCD) using bcdedit to enable 'Safe Mode with Networking' on the next reboot. Adversaries, including Akira ransomware affiliates, use this technique to bypass endpoint detection and response (EDR) solutions by ensuring they do not start when the system boots in a restricted safe mode.
Page 450 of 1168