Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects PowerShell command execution patterns indicative of the VelvetCake malware module. The rule identifies scripts that enumerate files within the C:\Users\Public directory, calculate file metrics using [math]::Round, and stage discovered files for transmission over a raw TCP connection using System.Net.Sockets.TcpClient.
Detects a malicious, trojanized Electron-based application masquerading as 'Claude Opus 5 Free Desktop'. The rule identifies specific artifacts embedded within the binary, such as GitHub repository paths, internal Electron loader scripts (snmc.js), and staging patterns associated with the RevStealer infostealer campaign attributed to the Water Curse threat actor.
Detects the use of PowerShell to load .NET Windows Forms and Drawing assemblies to perform screen captures. This behavior is associated with the VelvetCake second-stage module, which uses these libraries to capture full display screenshots and save them as timestamped PNG files to temporary directories.
Detects the RevStealer malware family using an Electron-based loader to perform anti-sandbox host validation. The loader attempts to identify virtualized environments by querying GPU hardware information using wmic or PowerShell CIM/WMI commands before proceeding to disable security features or launch the payload.
This rule detects HTTP GET requests containing specific URI parameters (OKey, Who, Areyou=cake) indicative of communication patterns associated with the Konni and VelvetCake malware families during exfiltration or command-and-control operations.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' or the execution of a related VBScript, which are commonly used by adversaries for persistence and code execution. This rule monitors process creation events for indicators of malicious task scheduling or script execution mimicking legitimate update processes.
Detects a specific raw TCP handshake sequence used by the VelvetCake downloader malware to authenticate with its Command and Control (C2) server. The rule monitors for a 'PASSWORD ' string followed by a 'GET qqq' command in the initiation of an established outbound TCP connection.
Detects suspicious execution of ServiceModelReg.exe, either by referencing a specific known malicious file path ('purosangue.tx') or when launched by an unexpected parent process. This activity is indicative of potential COM elevation moniker abuse or process hollowing techniques often used in post-exploitation scenarios.
Detects sign-in activity using pre-existing durable session tokens (e.g., PRT, broker-based tokens) that occur shortly after a password reset, suggesting that the adversary has maintained persistent access despite the credential change.
Detects usage of the OAuth device code authentication flow by high-value accounts (Finance, Accounts Payable, Admins). This flow is often abused in phishing campaigns to obtain access tokens by coercing users to authorize malicious applications via a code entry process.
Page 495 of 1168