Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
Detects the spawning of suspicious processes like cmd, powershell, or certutil by the Exchange Server's web worker process (w3wp.exe), which is a common indicator of post-exploitation activity following an initial web vulnerability exploitation, such as ProxyLogon.
Detects Python scripts containing natural-language comments that narrate attack rationale, reasoning, or step-by-step intent. This behavior is a diagnostic signature of scripts generated or operated by AI agents, which tend to document their own processes in plain text comments, unlike human-written malicious code.
Detects the execution of processes related to the 'Toy Ghouls' bird-agent tool delivery, utilizing Evil-WinRM or WinRM-fs to execute commands remotely via the WinRM service (wsmprovhost.exe).
Detects the creation of a new local user account followed by its immediate addition to the Administrators or Remote Desktop Users groups, a common pattern observed in post-exploitation activities related to CVE-2019-0708 (BlueKeep) for achieving persistent administrative access.
Detects the execution of Mimikatz, a tool commonly used for credential harvesting from Windows memory, by monitoring for processes named 'mimikatz.exe' or the presence of specific Mimikatz command-line arguments used for dumping LSASS memory or performing pass-the-hash attacks.
Detects the execution of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) used by the Monkey ransomware C++ variant to delete volume shadow copies, clear the backup catalog, and disable system recovery boot policies. This activity is a characteristic precursor to data encryption.
Detects the use of offensive security tools like Evil-WinRM or winrm-fs, which are often used by threat actors for remote administration, lateral movement, or backdoor delivery via the Windows Remote Management (WinRM) protocol.
Detects the use of the Rubeus tool for Kerberos-based credential attacks, specifically Kerberoasting, TGT delegation abuse, and Pass the Ticket, by monitoring process command line arguments for characteristic flags associated with the Rubeus binary.
This rule monitors for a collection of adversarial behaviors on Windows systems, including persistence mechanisms via scheduled tasks and registry run keys, tampering with security services (VSS, Windows Defender), credential harvesting attempts (LSASS memory), log and history clearing, and external network communication to known IP geolocation services.
Page 503 of 1168