Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-frequency loading of core Windows GDI libraries (gdi32.dll, gdi32full.dll, user32.dll) by the ProcAuditManager.exe process, which is indicative of screen capture activity associated with the SparroWocky malware's persistence and data exfiltration capabilities.
This rule detects repeated PowerShell executions using 'Start-Process' with the 'RunAs' verb and hidden window styles. The detection specifically looks for high-frequency occurrences of these commands within a tight 18-25 second window on the same host, which is characteristic of certain automated execution or privilege escalation attempts.
Detects instances where a process is created with a session ID that differs from its parent process, which is indicative of token manipulation or impersonation techniques like those observed in SparroWocky. The rule looks for cross-session process creation using the CreateProcessAsUserW API or specific command-line argument patterns.
Detects a multi-stage PowerShell execution pattern often associated with 'ClickFix' or similar social engineering lures, where a base64-encoded or obfuscated command is used to invoke malicious network downloads (IEX, WebClient, DownloadString). The rule further correlates these execution patterns with potential persistence mechanisms, specifically monitoring modifications to Windows startup locations or Run keys.
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
This rule detects anomalous, high-frequency actions performed by browser extensions that lack concurrent user interaction events (such as keyboard input, clicks, or gestures). It monitors for automated browser API calls or prompts originating from web browsers like Chrome, Edge, and Opera that exhibit potential malicious behavior, such as silent data collection, navigation, or unauthorized scripting.
Detects the execution of NetSupport Manager's 'client32.exe' process. This remote administration tool is frequently abused by threat actors for unauthorized persistence and remote control after being delivered via malicious payloads such as Google Apps Scripts in phishing campaigns.
Detects reflective memory mapping and reflective code loading activities consistent with the SparroWocky payload. The rule identifies suspicious memory configurations, specifically executable and writable (RWX) memory regions that are not backed by a corresponding file on disk, often associated with memory-only execution techniques. It also monitors for execution artifacts related to NtMapViewOfSection or reflective loading keywords.
Detects reflective memory mapping and reflective code loading activities consistent with the SparroWocky payload. The rule identifies suspicious memory configurations, specifically executable and writable (RWX) memory regions that are not backed by a corresponding file on disk, often associated with memory-only execution techniques. It also monitors for execution artifacts related to NtMapViewOfSection or reflective loading keywords.
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
Page 510 of 1168