Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
Detects successful OAuth device code authentication flows targeted at sensitive Microsoft cloud resources (Exchange Online, SharePoint, Teams, Graph) originating from unmanaged or non-compliant devices. This pattern is often indicative of consent phishing or device code phishing attacks where an adversary obtains a device token to gain long-term unauthorized access to user data.
This rule detects the creation of files with NTFS Alternate Data Streams (ADS). Adversaries often use ADS to hide malicious payloads or tools within the file metadata of legitimate-looking files to evade static analysis and security monitoring.
Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.
Detects malicious activity related to the 'RoguePlanet' exploit (referencing CVE-2026-50656) which involves manipulating NTFS junctions to redirect system file operations. The rule monitors for specific staging directory patterns (RP_<UUID>), the creation of named pipes associated with RoguePlanet, and the execution of suspicious binaries or staging of files in system paths.
Detects DLL sideloading and suspicious module loading by legitimate signed executables from user-writable directories (e.g., AppData, Temp). This covers known techniques used in campaigns like TA4922, targeting executables such as AnyDesk and vulkaninfo.exe to load unauthorized DLLs.
Detects instances where Microsoft Teams or its associated process spawns remote assistance utilities such as Quick Assist, Microsoft Remote Assistance (msra), or Remote Desktop Connection Manager (msrdcw). This behavior may indicate an attacker abusing legitimate remote access software for command and control or unauthorized remote control.
Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.
Detects suspected RomulusLoader activity by identifying the sideloading of 'vulkan-1.dll' from non-standard directories, the creation of encrypted 'vulkan-1.bin' payload files, and the loading of unsigned DLLs from user-writable directories (Temp/AppData) by otherwise signed processes.
Detects the creation of log or data files in temporary directories (e.g., AppData, Temp) by non-standard processes. This behavior is indicative of keylogging activity performed by malware families such as Atlas RAT and Gh0stRAT, commonly associated with the threat actor TA4922.
Page 600 of 1168