Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous, high-volume file access (downloading, accessing, or previewing) in cloud applications that originates from an IP address identified as an anonymous proxy. This behavior is indicative of potential data exfiltration or unauthorized mass data collection.
Detects suspicious reconnaissance or modification activity within Microsoft Graph API by identifying high volumes of requests targeting sensitive management endpoints (such as directory roles, authentication methods, service principals, or OAuth permissions) from a single actor within a 30-minute window.
This rule detects PowerShell processes spawned directly or indirectly by LNK files that include command-line arguments indicative of anti-analysis, anti-VM, or reconnaissance techniques. These include querying for specific WMI classes (e.g., Win32_Process, Win32_ComputerSystem), checking for virtualization artifacts (e.g., 'virtualbox', 'vmware', 'qemu', 'sandboxie'), or querying security and hardware information (e.g., 'antivirusproduct', 'securitycenter2', 'getmac').
Detects the use of .NET reflection methods (such as Assembly.Load or LoadFrom) within command-line arguments of processes frequently abused for secondary execution (e.g., rundll32.exe, regsvr32.exe) when initiated by common scripting or execution engines like PowerShell, cmd.exe, or mshta.exe. This pattern is indicative of fileless malware execution or reflective assembly loading commonly used to bypass traditional signature-based detection.
Detects HTTP responses containing JavaScript-based anti-bot challenge patterns commonly used by phishing kits to identify and block automated crawlers, security scanners, and headless browsers.
Detects the loading of the 'user32.dll' library into a process named 'firefox.exe' where the process is either unsigned or executing from a suspicious location like 'ProgramData'. This pattern is consistent with the behavior of BabylonRAT, which masquerades as the Firefox browser to perform keylogging by hooking system APIs.
This rule detects instances of a process named 'firefox.exe' that is executing from a directory other than the standard 'Mozilla Firefox' program folders. When this masquerading process loads critical system DLLs like 'kernel32.dll' or 'ntdll.dll', it flags potential dynamic API resolution activity commonly associated with BabylonRAT and similar malware that attempts to hide its capabilities by resolving system functions at runtime.
Detects periodic outbound network connections from internal hosts to external networks, consistent with command-and-control beaconing behavior often observed in malware like BabylonRAT.
Detects the execution of OrionQuests-Setup.exe, a .NET-based executable identified as a malicious installer used by the Kimsuky (APT-C-55/BabyShark) threat group. The rule flags PE files that match the specific filename and contain both .NET framework indicators and references to LNK files, suggesting the dropper mechanism for initial stage infection.
Detects potential device code authentication phishing attacks by correlating a successful device code authentication event with a subsequent non-interactive sign-in from a suspicious user agent (Python Requests or specific Outlook versions) within a 10-minute window. This behavior is indicative of an adversary using a device code phishing lure to capture a token or session, followed by automated access via a script or impersonated client.
Page 554 of 1168