Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of PowerShell commands that perform decryption (AES-256-CBC) and decompression (Gzip) of data, followed by the reflective loading of a .NET assembly into memory using [Reflection.Assembly]::Load. This behavior is indicative of fileless malware execution where a payload is hidden in an obfuscated or compressed format and unpacked at runtime.
Detects PowerShell instances performing suspicious memory operations like thread injection (e.g., VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) targeting common processes such as csc.exe, browser processes (chrome.exe, msedge.exe), and system processes like SearchIndexer.exe. This activity is indicative of malicious code injection often used in stealth execution and credential harvesting campaigns.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the execution of the 'reagentc.exe' utility with the '/disable' argument. This command is used to disable the Windows Recovery Environment (WinRE), which is a common post-compromise activity performed by ransomware and other malware to prevent system recovery and hinder incident response efforts.
Detects unexpected child processes spawned from directories associated with AI coding agent plugins (e.g., Claude Code, Copilot, Codex, Gemini CLI). This activity could indicate post-exploitation behavior, such as Plugin4Shell, where a malicious plugin auto-update facilitates remote code execution.
Detects network activity related to 'ClickFix' social engineering campaigns. The rules monitor for DNS queries, TLS SNI requests, and HTTP requests to the malicious domain 'cdnsuicaches.com' used for hosting malicious scripts, as well as the identification of the 'cookie-captcha-complete' string in HTTP traffic, which is a known indicator of a ClickFix social engineering overlay.
Detects instances of PowerShell being launched directly from Windows Explorer (explorer.exe) using suspicious command-line arguments. This pattern is commonly associated with malicious scripts, remote access trojans, or fileless execution techniques where an adversary executes code through shell-based file interaction.
Detects the creation of an LNK file in the Windows Startup directory, a common technique used to achieve persistence by executing a specific program or script upon user logon.
Detects PowerShell attempts to perform remote process injection into potentially suspicious or sensitive processes (csc.exe, chrome.exe, msedge.exe, SearchIndexer.exe) by searching for command line arguments indicating the usage of Windows memory allocation or thread context manipulation APIs such as NtAllocateVirtualMemoryRemote and NtSetContextThreadRemote.
Page 475 of 1168