Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.
Detects DNS queries and established TLS connections to free.pinggy.io, a service often used to establish unauthorized reverse tunnels to internal networks, bypassing perimeter security controls.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects established outbound TCP connections to a known AsyncRAT C2 IP address on port 4944. This rule identifies infected internal hosts communicating with a malicious server typically used for remote access and control.
Detects the loading of amsi.dll or clr.dll into the charmap.exe process. Adversaries often inject malicious code into legitimate, system-native processes like charmap.exe to bypass detection and perform in-memory patching of security controls, such as disabling AMSI (Antimalware Scan Interface).
Detects unauthorized access to Discord's Local Storage leveldb files, a technique commonly used by malware like LxBaseRAT to extract Discord authentication tokens.
Detects the creation of scheduled tasks named after Microsoft Edge updates or the execution of suspicious Wscript commands, which may indicate persistence or execution by the LxBaseRAT malware.
This rule detects the execution of the LXBASE.exe malware and identifies specific strings within the process memory or image that correspond to the LxBaseRAT Hidden Virtual Network Computing (HVNC) module, indicating potential unauthorized remote access activity.
Detects outbound network connections initiated by charmap.exe, a standard Windows utility that does not naturally communicate over the network. This activity is highly indicative of process injection or malicious code masquerading as a system utility to facilitate credential theft or command and control communication.
Detects PowerShell script activity that leverages low-level Windows API calls, such as SetWindowsHookEx and GetAsyncKeyState, which are frequently used by the LxBaseRAT malware to implement keylogging functionality by monitoring user keystrokes.
Page 505 of 1168