Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects DNS queries directed at known OAST (Out-of-band Application Security Testing) domains, such as 'dnslog.ink' and 'digimg.store', which are commonly used in the 'LucidPawn' framework for verifying external connectivity or exfiltrating data during initial discovery and post-exploitation phases.
Detects the activity of the PIVOTPIPE .NET loader, which involves writing specific artifacts (core.pak, agent.json, pk.der, or sleepmask.o) to a temporary directory with the 'nb_' prefix or the creation of debug files containing strings associated with in-memory reflective loading of a remote access tool (RAT).
Detects network beaconing and communications associated with the NetSupport Manager remote access tool. The rules monitor for outbound connections to a known actor-controlled IP/domain and identify unauthorized client responses containing a specific license serial number.
Detects a 'force-push' operation in a Git repository where the pushed commit is not cryptographically signed. This behavior is often indicative of repository tampering, such as overwriting commit history to remove audit trails, hide malicious code injection, or facilitate unauthorized repository modifications.
This rule detects network traffic patterns associated with the RatHat Android malware. Specifically, it monitors for HTTP requests targeting the '/api/sapp' or '/api/bapp' URIs, which are used by this malware for C2 evasion or to retrieve its block list.
Detects thread creation events where the initiating module is ntdll.dll, bypassing the conventional CreateThread path originating from kernel32.dll. This is a common behavioral indicator of process injection techniques used to hide malicious thread execution.
Detects evidence of persistent Android malware attempting to maintain access. It identifies the execution of a hidden Go-based daemon masquerading as a shared library in temporary storage, silent reinstallation of malicious APKs using package installer flags, and automated re-granting of accessibility services to bypass user interaction requirements.
This rule detects potential keystroke logging activities on Android devices by monitoring the 'UniversalInputMonitor' accessibility service. This service is abused by the RatHat malware family and similar threats to capture user input, including passwords, PINs, and text entered into masked fields, by intercepting accessibility text events.
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
Page 514 of 1168