Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,560 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects administrative role assignments or additions, such as 'Global Administrator', occurring for a user shortly after a device code authentication event. This pattern is indicative of ARToken-based post-compromise activity where an adversary uses an illicitly obtained device code to escalate privileges within a cloud environment.
This rule detects the execution of the legitimate Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) from an unauthorized file location. This behavior is indicative of masquerading, where the executable is renamed to appear as an installer to sideload a malicious companion vsdbg.dll, a technique observed in the Rapuncel/BoryptGrab campaign.
This rule detects two suspicious indicators related to SloppyRAT activity: an outbound network connection using the legacy Finger protocol (TCP port 79), which can be abused by binaries like 'finger.exe' for payload staging, and DNS queries resolving to the known SloppyRAT staging domain 'finger.linked4x.com'.
Detects attempts by malicious software, specifically SloppyRAT, to query or modify Microsoft Defender settings by interacting with WMI classes like MSFT_MpPreference or MSFT_MpComputerStatus. This activity is indicative of efforts to disable security controls such as real-time monitoring to facilitate further malicious actions.
Detects evidence of SloppyRAT employing the Hell's Gate technique, specifically the resolution and indirect invocation of low-level NT system calls (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) designed to bypass EDR user-mode API hooking during process injection activities.
Detects network activity associated with the SloppyRAT malware, specifically tracking the polling mechanism for reverse SOCKS proxy tasks and subsequent acknowledgment of these tasks via HTTP requests.
Detects instances where a user signs in via a Device Code authentication flow and subsequently adds a member to a highly privileged group (e.g., Domain Admins, Global Administrators) within one hour. This behavior is indicative of potential account compromise where an attacker uses an OAuth device code flow to establish access and then escalates privileges.
Detects the mass termination of multiple security-related processes on a host within a short timeframe, correlated with the presence of specific driver modules potentially associated with security software interference or evasive behavior.
This rule monitors network and event logs to detect instances where a single user account, logged into a specific host, initiates connections to two or more distinct, potentially suspicious remote IP addresses. This pattern of multi-destination connection activity may indicate command and control communication, scanning behavior, or data staging.
Detects suspicious device registration or join events occurring within 60 minutes of a Device Code authentication flow. This pattern is consistent with the ARToken post-compromise technique, where an adversary uses an intercepted authentication code to register a new device to maintain persistent access to an Entra ID (Azure AD) environment.
Page 453 of 1168