Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects the creation of a Windows service named 'ProcAuditManager', which is a known indicator of the SparroWocky backdoor attempting to establish persistence on a system.
Detects PE binaries that are either signed with Discord Inc. certificates but do not contain expected Discord metadata, or binaries that are signed with Lenovo certificates but contain indicators (e.g., 'DocSend') that suggest unauthorized use. It also detects any binaries claiming to be signed by these entities that contain invalid or untrusted signatures, identifying attempts to bypass security controls using stolen or spoofed certificates.
Detects the creation or modification of a browser extension 'manifest.json' file that requests both 'declarativeNetRequest' and 'contentScripts' permissions. These permissions are frequently associated with browser-based session hijacking, traffic redirection, and unauthorized data injection, common in malicious extensions.
Detects the installation of a rogue root certificate into the operating system's trust store. This is a common technique used by adversaries to perform TLS/SSL interception (Adversary-in-the-Middle) by establishing a chain of trust for malicious proxy traffic. The rule identifies suspicious use of Windows 'certutil' to add certificates to the 'Root' store, macOS keychain certificate management commands, and indicators associated with 'Localcertificate.zip' payloads.
Detects various persistence methods associated with NetSupport Manager, a legitimate remote management tool often abused by threat actors. The rule monitors for the installation of NetSupport components (specifically client32.exe) in Windows registry run keys, Winlogon configuration, service creation, and keyboard filter drivers.
Detects instances of the Comet AI agent (comet.exe) accessing files on the local filesystem outside of expected directories such as the browser's download directory, application profile, or temporary folder. This behavior is indicative of a compromised or malicious agent attempting to exfiltrate or interact with arbitrary local files.
Detects components associated with the SparroWocky trident loader, specifically targeting side-loaded DLLs (DukeQt.dll or winfsp-x64.dll) and .dat data containers that contain a specific magic value (0x11328712) and RC4 strings, indicating in-memory payload decryption and mapping.
Detects a process re-launching itself with a specific command-line argument format (a single 's' character followed by a numeric session ID). This behavior is characteristic of the SparroWocky malware, which enumerates user sessions and spawns a new backdoor instance under a different session using CreateProcessAsUserW after duplicating the target session's token.
Detects the Chrome process attempting to programmatically modify the Windows CapabilityAccessManager ConsentStore registry keys for microphone or webcam access. This behavior is indicative of unauthorized programmatic access to system audio/video peripherals, often associated with browser-based AI agent hijacking or malicious extensions attempting to bypass user interaction requirements.
Page 509 of 1168