Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potentially malicious script execution patterns, specifically targeting Windows Script Host (wscript.exe) invoking .vbs or .wsf files, and PowerShell execution involving suspicious command line arguments such as encoding (-enc), external URL downloading, or attempts to execute or archive files (Expand-Archive, WebClient DownloadFile).
Detects the execution of a file named 'msedge.exe' residing within the C:\ProgramData\Microsoft\Windows\Telemetry\ directory. Microsoft Edge typically resides in 'C:\Program Files (x86)\Microsoft\Edge\Application\', making execution from the telemetry directory highly suspicious and indicative of potential process masquerading.
This rule detects potentially malicious activity by monitoring for a specific executable file name ('msedge.exe') located in a non-standard path ('ProgramData'), as well as network connections to a known malicious IP address ('193.23.118.155') and DNS requests for a domain associated with suspicious activity ('deadhub.org').
This rule detects the execution of a file with a suspicious media-themed filename (e.g., related to 1080p, BluRay, etc.) from a known BitTorrent client process, followed by an immediate network connection to a known malicious C2 IP address or domain within a 10-minute window. This behavior is indicative of a user downloading and executing a malicious file disguised as pirated media.
This rule detects the execution of a specific known malicious file (identified by MD5 hash A0B13781EDD7CFDAB13D79AFFF3C83C1) followed by an outbound network connection to a suspicious IP address (193.23.118.155) or domain (deadhub.org) within a 10-minute window. This behavior is indicative of a malicious loader establishing a command and control (C2) channel.
This rule detects potential persistence and execution activity associated with the HEAVYGRAM implant. It monitors for registry value modifications in the Windows Run keys by known malicious file names, as well as process execution events where those same files are executed with command-line arguments typically used for registry manipulation.
Detects unauthorized Android Debug Bridge (ADB) commands or modifications to Android system settings that enable Wireless Debugging or Developer Options, originating from non-system applications. This behavior is indicative of malware or malicious actors attempting to maintain persistence or remote access via Android debugging interfaces.
Detects execution of malicious binaries ('liblocal-service.so', 'frpc', 'local-service.update') or suspicious shell commands on Android devices consistent with the RatHat malware family. The rule monitors for unauthorized APK installations, modification of accessibility service settings, and manipulation of system standby/doze modes via adb or local shell commands.
This rule detects potential credential exfiltration by the RatHat malware, which attempts to upload 'cert.pem' and 'private.key' files to a remote server using a POST request to '/api/adbk/upload'.
Detects the execution of suspicious binaries that are spawned by known torrent clients or appear to masquerade as media files (e.g., using movie quality naming conventions like 1080p, Bluray). This rule identifies potential delivery of malicious payloads via P2P file sharing environments by looking for specific process patterns and filename indicators associated with file masquerading.
Page 516 of 1168