Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution or loading of modules, processes, or command lines associated with the Stella_Gary C# backdoor framework. This framework is utilized by the Kimsuky (APT-C-55) threat group as part of a modular, plugin-based capability loading architecture.
Detects PowerShell command lines that perform environment validation by enumerating running processes for security software (AV/EDR/Analysis tools) and querying WMI for virtualization artifacts. This behavior is consistent with anti-analysis and anti-sandbox evasion techniques used by threat actors, such as Kimsuky, to identify and verify the execution environment before proceeding with malicious activity.
Detects anomalous, rapid registration of rogue devices following a device-code authentication flow. The rule identifies instances where an 'unbound' device registration is immediately followed by a 'bound' call to obtain Azure AD and Microsoft Graph tokens, or where a Primary Refresh Token (PRT) is acquired shortly after a device-code sign-in, indicating potential abuse of the device authorization grant flow by an attacker using phishing kits.
Detects files that are masquerading as Rich Text Format (RTF) documents but do not contain valid RTF magic bytes and instead contain embedded Portable Executable (PE) headers or DOS stubs. This behavior is indicative of malware delivery via file-type masquerading, often used in spearphishing campaigns by actors such as Kimsuky.
Detects unauthorized modifications to the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts). Adversaries frequently modify this file to perform DNS hijacking or domain redirection, steering users to malicious infrastructure or bypassing security controls. The rule filters out known legitimate system processes that typically interact with this file.
Detects the use of the SetWindowsHookEx API with WH_KEYBOARD_LL, which is a common technique used by malware like BabylonRAT for keylogging. The rule specifically alerts when this hook is initiated by a process masquerading as Firefox that resides outside of the legitimate installation directories.
Detects unauthorized processes attempting to access sensitive browser credential storage files belonging to Google Chrome (Login Data) and Mozilla Firefox (key4.db, logins.json). This behavior is indicative of credential harvesting often performed by infostealers like BabylonRAT.
This rule detects network activity associated with GhostCode phishing campaigns. It monitors for suspicious TLS SNI fields and HTTP Host headers matching known device-code phishing subdomain patterns (e.g., [service]-access-[8-chars].[domain]). Additionally, it detects requests to specific known malicious hostnames and high-entropy URI paths indicative of phishing kit redirects.
Detects HTTP traffic patterns associated with C2 infrastructure challenges, specifically looking for anti-bot/anti-scanner responses containing specific JavaScript variables ('badAgents', 'js_enabled=1') and subsequent client-side validation requests containing a specific token structure and 'check=1' parameter.
Detects the creation of Windows Run registry keys by a process named 'firefox.exe' that originates from a non-standard file path. This behavior is indicative of BabylonRAT attempting to establish persistence by masquerading as the Mozilla Firefox browser.
Page 559 of 1168