Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Detects execution of PowerShell with encoded commands ('-enc') and window style hidden ('-w 1') initiated by processes associated with Fortinet FortiClient (e.g., scheduler.exe, fortitray.exe), or matching known encoded command patterns. This often indicates the use of legitimate management processes to execute obfuscated malicious scripts.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects anomalous system reconnaissance and potential anti-VM sandbox evasion behaviors exhibited by processes. The rule aggregates distinct indicators such as system information gathering (systeminfo, wmic), virtualization environment probing (VMware Tools detection), registry-based identity checks (MachineGuid, ComputerName), and broad enumeration of HKLM\SOFTWARE vendor keys, identifying processes that perform three or more of these distinct actions within a 5-minute window.
Detects a sequence of suspicious activities characteristic of information-stealing malware (e.g., Vidar/SnappyClient). The rule correlates browser credential access (Login Data/Cookies), screen capturing (GDI API calls), and keylogging (SetWindowsHookEx) with subsequent archive staging activities (compression of sensitive data in temp folders) within a one-hour window.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
Detects DLL side-loading techniques associated with Operation Turb00. This rule monitors specific legitimate applications ('WizardDa42.exe' and 'AlphVector.exe') as they load known trojanized DLLs ('Qt5Core.dll', 'WebView2Loader.dll', 'opera_elf.dll') from staging directories like 'C:\ProgramData\extadvanced_arm64\' or the user's TEMP directory, while excluding loads from standard 'Program Files' locations.
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Detects the use of the 'diagnose sniffer packet' command on a FortiGate network device, which is indicative of an administrator or attacker performing network traffic capture and analysis directly from the device's management interface.
Page 582 of 1168