Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of a scheduled task named 'MicrosoftEdgeUpdateTaskUserS-1-5-24' which triggers conhost.exe with the --headless argument or PowerShell with an EncodedCommand. This behavior is indicative of a malicious persistence mechanism masquerading as a legitimate Edge update task, specifically associated with the retrieval of payloads from the malicious domain 'indiatodays.org'.
This rule performs a wide aggregation of logs across proxy, cloud, GitHub, and network destination data sources. Because it lacks specific filtering logic or behavioral indicators, it does not detect any specific attack technique and serves only as a broad data collection query.
This rule detects the execution of the HTSPnew.Exe ransomware payload, associated with a trojanized HTS DLL, and subsequent ransomware-related file operations, such as the creation of .krsid encrypted files and the dropping of a Korean-language ransom note (README_KRSID.Txt).
Detects the execution of 'HTSPnew.Exe', a utility associated with suspicious activity or ransomware simulation, combined with command-line arguments that suggest testing, batch execution, or help requests.
Detects network traffic containing specific 'ASISFH' marker strings associated with the CrimsonRAT command-and-control protocol. These markers are utilized by the malware to obfuscate command tokens during C2 communication.
This rule detects HTTP traffic patterns consistent with a Golang-based Remote Access Trojan (RAT) beaconing to a command and control (C2) server. It monitors for specific fitness-themed URI paths used for C2 communication and identifies the use of a hardcoded domain ('monitorondomainwintgt') within both the HTTP Host header and the TLS SNI field.
Detects outbound network traffic to the GitHub API, a known communication channel for the RUSTYSHADE malware and APT36 (Transparent Tribe) threat group, occurring outside of a previously observed operational cadence (weekdays 04:00-11:00 UTC). Deviations from this baseline pattern on weekends or off-hours suggest unauthorized C2 activity or changes in actor infrastructure.
This rule detects scenarios where a specific parent process generates five or more child processes, which can be an indicator of suspicious automation, scripting activity, or potential brute-force behavior. It groups events by host and parent process image to identify potential anomalous process density.
This rule detects processes or file operations attempting to interact with the Docker daemon socket ('/var/run/docker.sock') by non-standard or unauthorized binaries. Accessing the Docker socket from a container can allow an attacker to escape to the host, manipulate other containers, or perform privileged actions on the Docker daemon.
The rule detects the deletion of specific log files ('Udydn.out', 'server.log', or 'derby.log') which are often associated with application operations or internal debugging. Adversaries may delete these logs to conceal their activities, remove indicators of compromise, or interfere with forensic analysis.
Page 530 of 1168