Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,572 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Detects opportunistic lock (oplock) placement on wermgr.exe alternative data streams or volume shadow copy paths. This behavior is associated with the RoguePlanet exploit chain, which attempts to pause the Microsoft Defender service (MsMpEng.exe) by creating a Time-of-Check to Time-of-Use (TOCTOU) race condition during the quarantine process.
Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.
This rule detects unauthorized exfiltration of stolen browser and credential data by the Yuta/Glove Stealer malware (winupdate.exe). It identifies outbound HTTPS network connections from the specific indicator file path '%APPDATA%\.cache\winupdate.exe' to known C2 endpoints, including Discord webhooks, Telegram bot APIs, or connections utilizing the 'python-requests' user agent.
Detects the Yuta/Glove stealer malware performing sandbox and virtualization environment evasion. The rule specifically monitors for the process 'winupdate.exe' attempting to query common registry keys associated with virtualization software (VMware, VirtualBox, VBOX, QEMU) and executing WMI commands to enumerate system manufacturer information via 'wmic.exe'. These actions are commonly used by malware to detect if it is executing within an analysis sandbox or VM to abort or alter its behavior.
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
This rule monitors for potential C2 communications and tunneling activity associated with the STAC4713 campaign. It detects outgoing network connections to known malicious IP addresses, traffic over specific non-standard ports used for tunneling, or the execution of QEMU (qemu-system-x86_64.exe), which is often used by this threat actor to host malicious services or tunnels. The rule includes logic to suppress benign, internal-only QEMU activity.
Detects command-and-control (C2) communication patterns associated with the threat group Obsidian Sandstorm (Storm-2571). The rule monitors for network connections and DNS queries to various Azure App Services subdomains initiated by suspicious processes running from user-accessible temporary directories (AppData or Temp), excluding known browser processes. This technique leverages legitimate cloud infrastructure for malicious command delivery.
Detects high-frequency, sequential authentication failures across multiple internal targets (SMB/LDAP) initiated from a single internal IP address. This behavior is consistent with credential spraying or lateral movement reconnaissance tools like NetExec or similar automation scripts, often originating from compromised internal assets such as virtual machines.
Detects potential supply-chain attack activity related to IronWorm, including modifications to the AppInit_DLLs registry key and the execution of Windows utility binaries (regsvcs.exe, regasm.exe, InstallUtil.exe) by npm or node processes, which are commonly abused to facilitate malicious code execution during package installation.
Page 596 of 1168