Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where FortiTray.exe or scheduler.exe (associated with FortiClient) initiate a cmd.exe process that subsequently launches a PowerShell process with hidden window (-w 1) and encoded command (-enc) flags. This pattern is indicative of a living-off-the-land attack where a legitimate, signed application process is abused to execute obfuscated malicious payloads.
Detects process hollowing behavior where a ClickFix-delivered loader payload targets legitimate Windows host processes like explorer.exe or svchost.exe. The detection looks for a combination of memory operations (NtUnmapViewOfSection, WriteProcessMemory, PAGE_EXECUTE_READWRITE allocation) and thread control (SetThreadContext, ResumeThread) indicative of malicious code injection.
Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.
Detects the post-exploitation behavior associated with EKZ Stealer, specifically the creation of a credential-containing log file in ProgramData, followed by the rapid deletion of the file and the source stealer binary. This behavior is indicative of anti-forensic cleanup steps often used to conceal credential harvesting activities.
Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
Detects high-frequency file write activity combined with the creation of text files, which is a common behavior exhibited by ransomware during the encryption phase of an attack. The rule monitors for a large volume of file creations across a host and specific patterns indicative of ransom note generation.
Detects the execution of systeminfo.exe or wmic.exe that terminates within 5 seconds. This behavior is indicative of automated environment or sandbox discovery techniques, often performed by malware loaders such as those associated with the Turb00 operation or similar campaigns to fingerprint the victim machine prior to executing malicious payloads.
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
Page 586 of 1168