Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Detects modification of user-level Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) specifically involving suspicious files, components, or potential masquerading attempts related to common startup applications like OneDrive.
Detects the execution of ADExplorer.exe, a legitimate administrative tool often abused by attackers to export Active Directory data. The rule specifically flags instances where the command line arguments include '-snapshot' or specify a '.dat' output file, which are strong indicators of unauthorized Active Directory data extraction or staging for offline analysis.
Detects the execution of Microsoft HTML Help (hh.exe) with a .chm file in the command line. Adversaries often use Compiled HTML files (.chm) to conceal malicious code and bypass security controls, as they can execute scripts or launch other payloads when opened.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
This rule monitors for instances where powershell.exe is spawned by cmd.exe, which in turn is a child process of the RemoteMouse application. It specifically flags command lines that involve network socket initialization or encoded commands, both of which are common indicators of malicious activity such as reverse shells or script-based attacks originating from a possibly compromised or malicious binary.
Detects instances where the Console Host process (conhost.exe) is executed at a System integrity level with a parent process of the Windows Error Reporter (wermgr.exe). This pattern is atypical as conhost.exe typically runs within the context of the user session or the initiating process, and spawning it from wermgr.exe at System level may indicate an attempt to hide a console window or manipulate system processes via an elevated parent.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
Detects the execution of known Remote Monitoring and Management (RMM) tools (AnyDesk, SyncFuture, QuickAssist, etc.) when launched by suspicious or untrusted parent processes. Additionally monitors for non-standard installation paths for AnyDesk and the creation of persistence registry keys for these RMM tools.
Page 581 of 1168