Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of a batch file named 'doxc.bat' using the Windows command shell (cmd.exe) that subsequently triggers actions related to specific file paths such as 'My_Resume.pdf' or locations in ProgramData, often associated with malicious staging or execution activity.
Detects the execution of processes named 'doxc' or 'hzwzucr_widsisa.exe', or processes matching specific file hashes, when originating from common user-writeable directories like 'ProgramData' or 'AppData'. This behavior is frequently associated with malicious payloads executing in non-standard or user-specific locations to achieve persistence or evasion.
Detects execution of Windows command shells (cmd.exe, powershell.exe) performing suspicious file deletion or renaming operations involving specific filenames associated with potentially malicious activities or malware components.
Detects the use of the 'net.exe' command-line utility to connect to the hidden IPC$ administrative share on a remote system, which is a common technique used for lateral movement and remote reconnaissance.
This rule detects potentially malicious activity by monitoring for file creation events within a specific 'FitnessPrograms' directory path and the execution of suspicious processes containing keywords related to command-and-control-like behavior (e.g., 'download_and_execute', 'checkCoachInstructions').
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects the creation of a scheduled task named 'StandAloneOneDriveUpdater-2626' using either PowerShell or the schtasks utility. This naming pattern is often associated with malware attempting to persist on a system by masquerading as a legitimate OneDrive update process.
Detects the execution of common command-line utilities used for network reconnaissance and discovery, such as arp, nbtstat, net, and ping. These commands are frequently used by adversaries to map network infrastructure, identify active hosts, and discover shared resources on a target network.
This rule detects unauthorized persistence attempts by monitoring for the creation of a registry value named 'DailyFitnessTracker' under the HKEY_CURRENT_USER Run key. It triggers when 'reg.exe' is used to add the key, PowerShell is used to set the registry property, or when a general registry event indicates the creation of this specific key. This behavior is indicative of a persistence mechanism designed to launch a potentially malicious or unwanted program upon user logon.
Detects the creation of hard links on a Windows system using utilities such as mklink or fsutil. Specifically, this rule identifies scenarios where a malicious executable located in %APPDATA% is linked to a backdoor binary stored in C:\ProgramData\, a technique used by adversaries to mask the true file path and evade security controls or detection mechanisms.
Page 479 of 1168