Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of cmd.exe with a parent process of RemoteMouse.exe or explorer.exe. This activity is indicative of synthetic keystroke injection, where malicious actors use applications like Remote Mouse to automate keyboard input—such as triggering the Start menu and typing commands—to achieve unauthorized code execution.
Detects persistence attempts via Windows Registry Run keys, specifically targeting indicators associated with UNC1549. The rule monitors Sysmon Event ID 13 for modifications to 'CurrentVersion\Run' keys, flagging entries containing specific filenames like 'FileCoAuth.exe' or 'secur32.dll', as well as generic write operations to AppData or Temp directories.
This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.
Detects the use of ADExplorer with the snapshot command to create Active Directory database snapshots, or the usage of 'net user' and 'net group' commands with the /domain argument. These techniques are commonly used by attackers to enumerate Active Directory users and groups to identify high-value targets within a domain.
Detects the hh.exe (HTML Help) process spawning wscript.exe. This behavior is a common indicator of a Compiled HTML (CHM) file executing an embedded malicious VBScript payload, often used for initial access or malware delivery.
Detects cmd.exe spawning powershell.exe with command-line arguments indicative of a reverse shell, specifically leveraging encoded commands or TCP socket objects. This pattern is characteristic of attackers injecting malicious keystrokes via the Remote Mouse Socket.IO service.
Detects a single user account authenticating via RDP (Logon Type 10) to three or more distinct target hosts within a 15-minute window, which is often indicative of an adversary performing lateral movement using compromised credentials.
Detects wscript.exe or cscript.exe executing VBScript to query WMI classes (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor) or 'Basic System' information. This activity is often used for host reconnaissance and fingerprinting by threat actors prior to C2 check-in, notably observed in Kimsuky multi-stage tradecraft.
Detects instances where a web browser process (e.g., chrome.exe, msedge.exe) initiates a cmd.exe process with a command-line argument containing '/c'. This behavior often indicates a drive-by download or a malicious script execution triggered via a browser exploit or phishing activity.
This rule detects potential lateral movement by monitoring for successful Remote Desktop Protocol (RDP) logons (Event ID 4624, Logon Type 10) occurring directly between workstations, excluding connections where the destination computer name indicates a typical server or infrastructure naming convention (e.g., ends with $).
Page 604 of 1168