Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
This rule detects various persistence mechanisms associated with the NetSupport Manager remote access tool. It monitors for the creation of services, scheduled tasks, registry modifications (such as Run keys, Winlogon Notify packages, and keyboard filter drivers), and process executions related to NetSupport Manager (specifically client32.exe).
Detects a suspicious multi-stage PowerShell execution pattern where an initial process utilizing obfuscated arguments (e.g., -EncodedCommand) launches a secondary PowerShell process that performs network operations indicative of downloading and executing a remote payload.
Detects the presence of Atomic macOS Stealer (AMOS) binaries and their associated malicious behaviors. The rule identifies suspicious artifacts including password prompt requests using osascript to deceive users, attempts to access keychain and browser credential databases, and the use of curl piping to remote shell execution which is a common delivery vector for this malware family.
Detects the creation or execution of a Windows service named 'ProcAuditManager', which is utilized by the SparroWocky backdoor for persistence. The malware masquerades as a legitimate system audit service to evade detection.
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects the presence of hidden DOM elements containing suspicious AI instructional phrases (e.g., 'ignore previous instructions', 'you are now') served in HTML responses from known AI assistant platforms. This behavior is indicative of a Prompt-Forcing attack, where an adversary attempts to manipulate the AI model's behavior by injecting hidden instructions that the user cannot see but the AI consumes.
Detects the frequent clearing of specific Windows Event Logs using the built-in wevtutil.exe utility. Attackers often clear logs to hide evidence of post-exploitation activity such as credential access, lateral movement, or persistence installation.
Detects repository activity involving the 'FETCH_HEAD' reference, which often indicates automated fetching, local caching, or potential attempts to manipulate or inspect the state of a Git repository during reconnaissance or post-exploitation activities.
Detects PowerShell command lines that attempt to hide the console window by calling ShowWindowAsync from user32.dll while assigning a randomly generated GUID as the window title. This technique is used to evade detection by keeping malicious PowerShell activity invisible to the user, as seen in recent StealC infostealer loader chains.
Page 511 of 1168