Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modification of the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts), which is a common technique used by malware to redirect network traffic, block access to security updates, or facilitate command and control communication.
Detects instances where a non-browser process attempts to read sensitive credential store files (e.g., 'Login Data', 'logins.json', 'key4.db') belonging to Google Chrome or Mozilla Firefox. This activity is indicative of credential harvesting often performed by malware.
Detects PowerShell scripts attempting to identify security software, virtualization environments, or sandbox analysis tools. The rule monitors for the enumeration of security processes, WMI queries for system hardware information (e.g., BIOS, Disk, Video Controller), and checks for registry keys or driver files associated with virtualization software (e.g., VMware, VirtualBox). This behavior is commonly observed in malware attempting to evade automated analysis.
Detects the reflective loading of .NET assemblies into memory using APIs like Assembly.Load or Reflection.Emit, where no corresponding DLL file is written to the disk. This technique is often used by malware (such as the Stella_Gary backdoor) to execute code in a fileless manner and evade disk-based security detections.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
This rule detects the presence of the unsigned 'OrionQuests-Setup.exe' file, which is a deceptive .NET installer associated with the Kimsuky (APT-C-55) threat actor, used to distribute the Stella_Gary backdoor. The rule looks for specific strings associated with .NET binaries and shortcut (LNK) file interaction, while excluding signed executables to reduce noise.
Detects repeated polling activity against a suspected device code endpoint, common in OAuth 2.0 device authorization grant phishing attacks where an adversary attempts to maintain session persistence or status checks for a stolen device code.
This rule detects activities associated with the GhostCode phishing kit, which leverages a device-code phishing flow. It identifies malicious URLs interacting with harvester APIs to retrieve codes, email-delivered lures containing specific phishing markers ('userCodeDisplay', 'Verified Enterprise'), and corresponding endpoint/browser telemetry showing the rendered phishing page elements.
Detects anomalous device registration or Intune enrollment activity where a single user principal name (UPN) is associated with three or more distinct source IP addresses performing registration actions within a 90-second window. This behavior is indicative of automated, rapid rogue device registration campaigns aiming to bypass conditional access policies or establish unauthorized persistence.
Detects potential device code phishing activity by identifying a successful device code authentication event followed shortly (within 10 minutes) by an interactive or API sign-in from the same user utilizing a Python-requests user agent, which is commonly associated with adversary-in-the-middle phishing kits.
Page 561 of 1168