Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of the AD Explorer tool followed by the creation of a .dat file within a 10-minute window. AD Explorer is a known administrative tool often used by adversaries for Active Directory reconnaissance, and creating or saving files with a .dat extension may indicate the export of captured AD data for further analysis or exfiltration.
Detects the use of the Windows Certutil utility to decode files or extract items from the cache, specifically looking for indicators often associated with file reassembly or extraction of payload components such as Link.dat or Link.ini files.
This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.
Detects the execution of the Windows command shell (cmd.exe) originating from either Windows Explorer or the RemoteMouse application. This activity often indicates an attempt to gain manual command-line interaction with the system, potentially through a malicious file execution, social engineering, or exploitation of the RemoteMouse application.
This rule identifies network connections over port 1313 that initiate a Socket.io WebSocket upgrade request. The detection checks for the presence of the '/socket.io/' URI path, the 'EIO=4' protocol version parameter, and the 'transport=websocket' requirement, which are characteristic of Socket.io communication. This can be used to monitor for potentially unauthorized C2 channels or application-specific tunneling.
Detects instances where cmd.exe spawns powershell.exe with command-line arguments indicative of malicious activity, such as network connection attempts via TCPClient or the use of Base64 encoded commands.
This rule detects a suspicious network connection on local port 1313 followed within 5 minutes by a PowerShell network connection to a non-standard port (not 80, 443, 8080, 8443). This behavior is characteristic of an initial exploit attempt targeting a service on port 1313, followed by a post-exploitation reverse shell.
Detects activity associated with the 'MiniBrowse.exe' process, which exhibits behaviors characteristic of unauthorized browser credential and cookie harvesting. This includes targeting browser 'Login Data' files, accessing cookies, attempting to interact with legitimate browser processes (chrome.exe, msedge.exe) via cross-process operations, and writing logs to 'edgeLog.txt'.
Detects the spawning of cmd.exe from common user-facing applications (e.g., Microsoft Office, web browsers, PDF readers) with command line arguments containing '/c'. This behavior is frequently associated with malicious document execution, drive-by downloads, or other initial access techniques where an attacker attempts to break out of the application sandbox to execute secondary payloads or perform reconnaissance.
This rule detects network connections on TCP port 1313 that explicitly use the Socket.IO protocol for WebSocket communication (URI path containing '/socket.io/?EIO=4&transport=websocket'). This pattern may indicate the presence of command and control (C2) traffic, web shells, or unauthorized application communications leveraging WebSocket tunnels over non-standard ports.
Page 587 of 1168