Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects forged thread call stacks by identifying processes that spoof legitimate thread entry points such as RtlUserThreadStart and BaseThreadInitThunk in kernel32.dll, a technique commonly associated with advanced thread execution hijacking methods like SilentMoonwalk or StackMoonwalk.
Detects anomalous child processes spawned by the Microsoft Exchange IIS worker process (w3wp.exe). This activity is often observed during post-exploitation phases of vulnerabilities like ProxyLogon (CVE-2021-26855), where attackers attempt to gain code execution by spawning command shells or administrative tools from the web server process.
This rule detects the presence or execution of known files 'winfsp-x64.dll' or 'DukeQt.dll' when located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, while excluding standard system or program installation paths.
This rule detects potential defense evasion activity identified by SentinelOne as call stack spoofing. The rule triggers when behavioral indicator tags related to spoofed call stacks, thread execution masking, or suspicious indicators involving RtlUserThreadStart, BaseThreadInitThunk, or kernel32.dll are detected, suggesting an attempt to hide malicious thread execution from security monitoring tools.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
Detects in-memory execution and stack-spoofing activities associated with the SparroWocky BOF loader (RunCOFF). It monitors for suspicious remote thread creation (EventCode 8), process access with highly permissive access masks (EventCode 10), and the loading of specific suspect DLLs (EventCode 7) that are indicative of this technique.
Detects instances where browser processes (chrome.exe or comet.exe) access multiple files in sensitive or unexpected directories (e.g., System32, /etc/, Documents) without an associated user click event. This activity often indicates potential malicious scripts or automated data collection running within the context of a browser process.
Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
Page 470 of 1168