Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the loading of specific DLLs ('winfsp-x64.dll' or 'DukeQt.dll') where the module path is empty or null. This behavior is indicative of potential memory-only execution or process injection (e.g., reflective loading), as the module is not associated with a valid file on disk.
Detects outbound network traffic (TCP and TLS) from internal hosts to known command and control (C2) infrastructure associated with the FamousSparrow threat actor and their SparroWocky malware suite.
Detects the presence of known synchronization objects (mutexes, events, or shared memory) associated with SparroWocky malware, identified via Microsoft Defender DeviceEvents and DeviceProcessEvents telemetry. The rule monitors for these specific markers in process creation, remote thread creation, and named pipe events.
This rule detects a process loading English (.en-US) MUI resource files from the C:\Windows\System32\en-US\ directory when the initiating process is located outside of standard system directories (System32, SysWOW64, Program Files). This behavior is indicative of a masquerading or camouflage technique where a malicious executable attempts to mimic a legitimate system process by loading its localized resources.
This rule detects remote thread creation where the start function address is identified as 'AnimateWindow'. This behavior is associated with the SparroWocky technique, which uses thread execution hijacking by pointing the thread start address to legitimate UI-related Windows APIs to mask the actual malicious entry point, thereby evading traditional detection mechanisms that monitor for suspicious thread start addresses.
This rule detects network traffic where the TLS Server Name Indication (SNI) field claims to be 'gemini.google.com', but the traffic is being directed to a non-Google destination. This is often indicative of an Adversary-in-the-Middle (AiTM) attempt to intercept or redirect traffic intended for legitimate AI service domains.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
This rule detects potential masquerading activity where an executable is signed by 'Discord Inc' or 'Lenovo' but the image path does not correspond to expected legitimate installation directories or filenames. It flags processes that claim a trusted publisher identity while residing in suspicious or unexpected locations.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Page 537 of 1168