Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,117 copies47 likes38,561 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
Detects instances where processes other than legitimate PowerShell binaries load the .NET Common Language Runtime (clr.dll) or the System.Management.Automation assembly. This behavior is often indicative of 'PowerShell-less' execution techniques, where adversaries interact with the PowerShell engine directly from arbitrary host processes to execute malicious code or scripts.
Detects the deletion of Google Chrome browser extension settings from the Windows Registry. Adversaries often target the 'extensions.settings' registry value under 'PreferenceMACs' to disable security extensions, force the installation of malicious extensions, or tamper with browser-based security controls.
This rule detects the installation of a new Windows service (Event ID 7045 or 4697) with an 'auto start' configuration that is immediately followed by the termination of multiple processes (either 'services.exe' or the service's own image file) within a 60-minute window on the same host. This pattern can indicate an unstable or malicious service deployment that causes system instability or performs rapid cleanup.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as finger.exe or curl.exe that are spawned by common Windows processes like explorer.exe or RuntimeBroker.exe. This behavior is often associated with adversaries attempting to download malicious payloads or stage tools within the environment.
This rule detects indicators of the Rapuncel browser injection by monitoring for the creation of a known malicious DLL hash on disk, identifying non-standard parent processes invoking elevation_service.exe, and detecting the loading of unrecognized DLLs into Google Chrome or Microsoft Edge browser processes.
Detects potential UAC bypass attempts using COM Elevation Monikers or the misuse of ServiceModelReg.exe, often associated with process hollowing techniques.
Detects potential reflective code loading or memory injection attempts within Python interpreter processes (pythonw.exe, ipy.exe). The rule monitors for processes that lack a valid module path or file path on disk while referencing known indicators of malicious memory-based loading, such as 'hostfxr.dll' or specific suspicious strings like 'DLLMemLoader'. This technique is often used to execute payloads directly in memory to evade file-based security controls.
This rule detects suspicious process activity in interpreters (ipy.exe, pythonw.exe) or rundll32.exe involving multiple, rapid consecutive calls to sensitive memory management and thread creation functions (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx). The logic specifically monitors for a high frequency of distinct, powerful Windows API calls, which is often indicative of reflective code injection or process hollowing, including techniques like 'Hell's Gate' or those associated with SloppyRAT, and accounts for potential .NET/hostfxr-related execution vectors.
Detects successful authentication events using the OAuth 2.0 Device Code flow, which is frequently leveraged by adversaries to perform phishing attacks and bypass traditional interactive login requirements.
Page 454 of 1168