Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing structured string patterns typical of exfiltrated Dahua camera credentials, including login, password, port, location, and channel information. This indicates an automated exfiltration attempt where stolen device credentials are sent to an adversary-controlled Telegram bot.
Detects outbound connections to and inbound responses from known command-and-control infrastructure associated with the SpiceRAT malware, as part of the SilkParasite campaign. This rule monitors established TCP traffic on ports 80 and 443.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects outbound network traffic from internal devices interacting with Dahua Easy4IP cloud relay services, specifically identifying device resolution requests, probe actions, and the submission of WSSE authentication headers (UsernameToken and PasswordDigest) to the cloud relay host.
Detects anomalous STUN bind-requests containing 'PTCP' headers directed at the loopback interface, commonly associated with the exploitation of Dahua P2P relay services for traffic redirection or unauthorized access.
Detects DNS resolutions for domains specifically associated with command and control infrastructure.
This rule detects unauthorized persistence attempts by monitoring for the creation of a registry value named 'DailyFitnessTracker' under the HKEY_CURRENT_USER Run key. It triggers when 'reg.exe' is used to add the key, PowerShell is used to set the registry property, or when a general registry event indicates the creation of this specific key. This behavior is indicative of a persistence mechanism designed to launch a potentially malicious or unwanted program upon user logon.
Detects execution of cmd.exe originating from potentially malicious or unexpected parent processes associated with RUSTYSHADE malware activity. This rule monitors for cmd.exe invoked by processes like 'DriverInstaller.exe' or 'Automata-20.exe', or processes other than standard Windows system processes (explorer.exe or services.exe), which is indicative of command-line shell abuse for malicious operations.
This rule detects potential data exfiltration by monitoring for screen capture activity, identified by API calls like BitBlt or CopyFromScreen or the loading of gdi32.dll, followed by the creation of a screenshot file and subsequent network connections to GitHub domains.
Detects the creation of suspicious scheduled tasks using either schtasks.exe or PowerShell's Register-ScheduledTask cmdlet. The rule specifically looks for masquerading attempts involving names like 'StandAloneOneDriveUpdater-2626', the usage of AtLogOn triggers, and the execution of the binary 'Automata-20.exe'.
Page 529 of 1168