Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Detects instances where the FortiTray.exe process is launched by the FortiClient scheduler (scheduler.exe). This pattern is typical of standard FortiClient operation, but can be used as a baseline for monitoring application behavior.
Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.
Detects instances where the FortiTray.exe process, associated with Fortinet client software, initiates a command shell (cmd.exe) with suspicious command-line arguments. This pattern is often indicative of potential process injection, command hijacking, or illegitimate execution triggered by the FortiTray binary.
This rule detects files created where the internal 'FileCreationTime' significantly deviates from the actual observed file-creation time. Specifically, it identifies files created more than 30 days in the past or with a future creation timestamp, which are common indicators of timestomping techniques used to hide malicious files or evade time-based forensic analysis.
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes, such as cmd.exe, powershell.exe, or wscript.exe. This behavior is associated with the exploitation of server-pushed echo-scripts, which can lead to arbitrary code execution on the client system.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
Detects the use of .NET reflection within PowerShell to access the 'AmsiUtils' class and set the 'amsiInitFailed' field to true. This technique effectively disables the Antimalware Scan Interface (AMSI) for the current PowerShell process, allowing subsequent malicious code or scripts to execute without being scanned for threats.
Page 607 of 1168