Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where a shell interpreter (bash or sh) accesses sensitive cloud and environment configuration files, specifically when initiated by parent processes associated with IDE-integrated development tools or AI assistants (claude, cursor, copilot-cli). This behavior suggests potential unauthorized access to credentials or environment variables.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
This rule monitors for indicators of process hollowing or memory injection targeting ServiceModelReg.exe. It correlates suspicious events including the creation of suspended processes, memory writes, remote thread creation, specific debug strings (e.g., RUNPE, PEB patched), and outbound network connections. This approach aims to reduce noise from legitimate use of ServiceModelReg.exe by requiring multiple indicators of malicious behavior.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
Detects the execution or presence of the EKZ Stealer binary by its known SHA-256 hash. EKZ Stealer is an infostealer malware that utilizes techniques like control-flow flattening and opaque predicates to evade static analysis and decompilation.
Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.
Detects the creation of a new Windows service where the service executable is located outside of standard system directories (e.g., C:\Windows\ or C:\Program Files\), which is followed by outbound network communication to known SnappyClient C2 ports 3333 or 3334.
Detects unauthorized processes attempting to access the ICMLuaUtil Elevated COM interface CLSID. This registry-based activity is indicative of a UAC bypass technique, where malicious actors, such as the ResiLoader threat, gain elevated privileges without triggering a standard UAC consent prompt.
Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.
Detects the execution of 'client32.exe', which is the executable for NetSupport Manager remote control software, when it is located outside of its standard installation directory. This can be indicative of a portable or unauthorized remote access tool being deployed by an adversary for persistence or command-and-control.
Page 592 of 1168