Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of the QEMU virtualization engine (qemu-system-x86_64.exe) when associated with specific toolset files (e.g., BloodHound, Metasploit) or suspicious network activity patterns indicative of lateral movement, such as connecting to administrative ports (SMB, RDP, WinRM) on external or sensitive network ranges. The rule calculates a risk score based on the presence of these indicators.
Detects User Account Control (UAC) bypass attempts involving registry hijacking of 'mscfile' or 'ms-settings' classes to execute arbitrary commands, and monitors for associated suspicious child process spawning from eventvwr.exe or fodhelper.exe.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Detects coordinated malicious behaviors associated with BQTLock ransomware, specifically identifying external IP reconnaissance, direct communication with known C2 infrastructure, abuse of the Telegram API for command-and-control or exfiltration, and host enumeration via system utilities by non-standard processes. The rule aggregates these suspicious signals and triggers an alert when multiple events occur within the same process storyline.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
Detects the execution of QEMU binary components (qemu-system-x86_64.exe, etc.) on Windows hosts when spawned by suspicious parent processes or with command-line arguments indicative of VM disk image handling or non-interactive execution. This behavior is used by threat actors to execute malicious payloads within a virtualized container to evade host-based EDR monitoring and security controls.
Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.
Detects the creation of a local user account (EventID 4720) or the addition of a user to sensitive local groups such as Administrators or Remote Desktop Users (EventID 4732). This behavior is common in persistence mechanisms used by threat actors such as BQTLock ransomware and GOLD ENCOUNTER.
Detects BQTLock ransomware activity where the BQT.exe process accesses browser credential stores (Chrome, Firefox, Opera) and writes the extracted data to a temporary file at C:\Windows\Temp\bqt_passwords.txt.
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Page 601 of 1168