Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects memory allocation operations in processes where the protection mask is set to PAGE_EXECUTE_READWRITE (0x40). This behavior is often associated with code injection techniques, where an adversary allocates memory with write and execute permissions to load or execute malicious payloads in memory.
Detects suspicious thread injection activities (CreateRemoteThreadApiCall, NtCreateThreadEx, or RtlCreateThread) or the loading of 'ntdll.dll' by specific potentially unauthorized binaries (e.g., RuntimeSSH.exe, smqdservice.exe, etc.) or within the 'ProgramData\Microsoft\Windows\Telemetry' directory. This often indicates reflective code injection or process tampering, excluding known legitimate Windows system processes.
Detects anomalous mass file enumeration, creation, deletion, and renaming activity within common system or temporary directories, indicative of the MovieReaper stage-4 file manager module. The rule monitors for the execution of command-line utilities (cmd.exe, powershell.exe) with specific file management arguments followed by a high volume of file system operations within a 5-minute window.
Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.
Detects malicious Android application activity where an app attempts to enable accessibility services and wireless debugging to perform unauthorized ADB pairing and connection. This technique is associated with the RatHat malware family to bypass sandbox protections and perform self-pairing for ADB access without user interaction.
Detects HTTP GET requests associated with the MovieReaper loader, specifically targeting shellcode fragment fetches from the deadhub.org domain, a specific fallback IP address, or requests to identifiable decoy asset paths used by the malware for staging or C2 communication.
Detects network beaconing and command-and-control (C2) communication patterns consistent with the HEAVYGRAM backdoor, which utilizes the Telegram Bot API for remote interaction. This rule monitors for encrypted SNI traffic directed at api.telegram.org, as well as specific HTTP polling and command execution patterns (e.g., /getUpdates, /bot<token>/) indicating automated interaction with a Telegram bot controlled by an adversary.
Detects execution of a process masquerading as msedge.exe located within the Windows Telemetry directory. This behavior is associated with the MovieReaper malware, specifically as a stage-3 payload activity following UAC bypass and persistence establishment.
Detects a Delphi-compiled Windows Screen Saver (.scr) file acting as a dropper. The binary contains embedded RCDATA ZIP resources and utilizes Persian-language filenames related to academic or student-focused lures to trick victims into execution. This rule specifically identifies the presence of the dropper's strings and the Borland Delphi marker.
Detects sophisticated process injection behavior where malicious shellcode is mapped into RWX memory. The payload utilizes a Vectored Exception Handler (VEH) and deliberate 0xCC (breakpoint) instructions to intercept execution and redirect it into raw syscall stubs (e.g., NtProtectVirtualMemory). This technique is designed to bypass security product API hooking by avoiding standard calls to memory protection functions.
Page 517 of 1168