Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the RatHat Android malware attempting to perform a UI overlay attack by requesting the SYSTEM_ALERT_WINDOW permission while specifically targeting payment application packages, such as WeChat (com.tencent.mm) and Alipay (com.eg.android.AlipayGphone), to capture sensitive credentials.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
Detects the execution of the Android 'getevent' utility with arguments indicative of monitoring raw input device events (e.g., /dev/input/, EV_ABS, ABS_MT_POSITION). This activity is often associated with monitoring user input, touch events, or keystrokes, which can be indicative of keylogging or user interaction monitoring.
Detects suspicious Android application installation attempts using the 'pm install' command, triggered by processes or libraries named 'local-service' or 'liblocal-service.so'. This behavior is often associated with the manual side-loading of potentially malicious APK files in an Android environment.
Detects the execution of PowerShell with commands intended to modify or interact with Windows Registry Run keys, a common technique for establishing persistence.
Detects the execution of PowerShell with commands intended to modify or interact with Windows Registry Run keys, a common technique for establishing persistence.
Detects execution of commands used to modify critical Android system settings, such as enabling accessibility services, developer options, or wireless debugging. These commands are commonly associated with the use of the Android Debug Bridge (ADB) to facilitate unauthorized device control, persistence, or configuration changes indicative of malicious activity or post-exploitation.
This rule detects modifications to the Windows 'Run' registry key intended to achieve persistence by launching potentially malicious executables named 'RuntimeSSH.exe' or 'winappx.exe'. Attackers often use these paths to ensure that their malicious code executes automatically upon user login.
This rule detects the loading of a module named 'MicDriver.dll' or the execution of a process named 'MicDriver.exe'. These filenames are potentially indicative of malicious activity using masquerading or attempts to hijack execution flow using filenames that resemble legitimate audio drivers.
Page 515 of 1168