Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of command-line arguments associated with the 'FortiEndpoint_Patch.exe' binary, which is used by the EKZ Stealer malware to perform credential harvesting operations such as listing, searching, viewing, exporting, or labeling sensitive data.
Detects instances where the FortiClient scheduler executable (scheduler.exe) spawns FortiTray.exe as a child process. While typically a legitimate operational behavior for the FortiClient application, this pattern is monitored to identify potential abuse where a trusted binary is leveraged as a proxy to execute secondary processes.
Detects instances where known Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) are executed without a corresponding UAC consent.exe process. This behavior is indicative of a UAC bypass, often facilitated by registry key modifications (COM hijacking) to manipulate how these binaries are launched.
This rule detects potentially malicious activity involving the ServiceModelReg.exe process, a known vector for ResiLoader process hollowing. It monitors for cross-process injection (e.g., process hollowing) and process creation events where ServiceModelReg.exe is spawned by suspicious parent processes (such as scripting engines) or originates from an unexpected location.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects unauthorized or unprivileged user-mode processes attempting to access files within Volume Shadow Copy paths. This behavior is indicative of reconnaissance or exploit techniques such as those observed in the RoguePlanet framework, where attackers enumerate snapshots to resolve stable file paths for subsequent malicious activity.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
Detects instances where FortiClient EMS (versions 7.4.5 or 7.4.6) logs a 'Certificate not found in request header' error. This indicates that a client attempt to communicate with the EMS server failed due to missing certificate-based authentication, which could suggest misconfiguration, network issues, or potentially an unauthorized attempt to access the management interface.
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys where the registered value points to suspicious locations such as Temp, AppData, or Downloads directories, which is a common technique for establishing persistence.
Detects the creation or connection of a named pipe with a name containing 'RoguePlanet'. Named pipes are a common inter-process communication mechanism that may be abused by malicious software for command and control, lateral movement, or execution, and identifying specific naming conventions associated with known threats is a common detection strategy.
Page 571 of 1168