Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects instances where Chrome or Microsoft Edge web browsers access local sensitive credential storage files (e.g., Login Data, Web Data, Cookies) from unexpected file system paths, combined with external network traffic from the same process instance. This behavior is indicative of potential malicious browser extension abuse, DLL sideloading, or unauthorized browser instance execution for credential exfiltration.
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, blinding EDR telemetry. This rule specifically looks for WriteProcessMemory API calls targeting ntdll.dll from processes like InstallUtil.exe, MSBuild.exe, and powershell.exe, which are commonly abused for code execution and evasion.
Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Detects unauthorized processes attempting to access, modify, or create web browser data files such as 'Login Data' (credentials), 'Cookies', and 'Local State'. This rule identifies potential credential theft activity where non-browser processes interact with sensitive browser storage files, which is a common tactic used by info-stealing malware.
This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Page 599 of 1168