Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,566 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects activities related to potential keylogging or unauthorized input monitoring on Android devices. It flags processes, classes, or raw log data associated with 'UniversalInputMonitor' and monitors for keywords commonly used in password or PIN input fields, or when Android accessibility services interact with masked input fields.
Detects the execution of processes with suspicious file names that are commonly associated with masquerading, potentially impersonating legitimate software or system tools.
Detects when common torrent client applications spawn a child process that is an executable. This behavior is often associated with the execution of malicious payloads delivered or masqueraded as files within torrent environments.
Detects the execution of suspicious executables spawned from common torrent client applications. This rule monitors for known malicious file hashes or processes launched by torrent clients with suspicious naming patterns typically associated with pirated software or malware masquerading as media files (e.g., tags like 1080p, x264, bluray in executable names).
This rule detects network traffic patterns associated with the RatHat malware, specifically the use of 'frpc' (Fast Reverse Proxy Client) to establish a persistent reverse proxy tunnel. The rule monitors for established outbound connections containing the specific byte sequence characteristic of this tool, which is often used by adversaries to facilitate Command and Control (C2) communication.
Detects the use of PowerShell to modify Microsoft Defender (MpPreference) settings by adding specific directories or files to the exclusion list. This behavior is frequently associated with adversaries attempting to evade security detection by ensuring malicious tools, staged payloads, or persistent files remain unscanned by the antivirus engine.
This rule detects potentially unauthorized network communication with AI platforms (OpenAI, Anthropic, Gemini) or Telegram from hosts executing suspicious processes or tools, such as 'frpc' (Fast Reverse Proxy), 'liblocal-service.so', or processes interacting with Android Debug Bridge (adb) utilities. This behavior often suggests the use of automated tools, remote tunneling, or interaction with AI models for post-exploitation tasks, such as code generation for malicious scripts or C2 activity.
Detects HTTP POST requests to the specific '/api/node/register' URI, which is associated with the RatHat RAT command and control (C2) node registration behavior.
Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.
Detects artifacts associated with the CRUDEEXCLUDE Delphi-based loader, which is used to deploy the HEAVYGRAM backdoor. The rule identifies a combination of Delphi indicators, anti-analysis sandbox connectivity checks, decoy message boxes, and attempts to modify Windows Defender exclusions for specific paths associated with the malware's activity.
Page 489 of 1168