Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains the specific strings 'MiniJunk' or 'MiniBrowse'. This pattern is often associated with the installation or persistence mechanisms of specific malicious software.
Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.
Detects network activity initiated by a process named 'Trustrap' communicating over common ports (80, 443, 53). The rule aggregates data by endpoint, process, and port, sorting by the frequency of connections to highlight potentially high-volume communication patterns.
Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.
Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.
Detects the execution of PowerShell with flags commonly used to obfuscate command lines or hide activity from the user, such as -EncodedCommand or -WindowStyle Hidden. These techniques are frequently used by adversaries to execute malicious scripts while avoiding detection.
Detects instances where a trusted process (defined by a signed executable) loads a DLL that is either unsigned, untrusted, or signed by a different entity than the parent process. This behavior is commonly associated with DLL hijacking or side-loading attacks originating from suspicious paths such as user profile directories, temporary folders, or public download areas.
This rule detects potentially malicious access to the Local Security Authority Subsystem Service (LSASS) process (lsass.exe). It correlates events where a process requests sensitive access rights (0x1010 or PROCESS_VM_READ) to LSASS with other activities indicating the presence of Mimikatz or related credential dumping tools (e.g., presence of 'mimikatz' or 'sekurlsa' in process names or command lines).
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
Page 579 of 1168