Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.
Detects network communication to the Telegram Bot API (api.telegram.org) initiated by processes other than standard web browsers. This behavior is indicative of malicious activity such as automated data exfiltration, C2 communication, or victim status reporting, as observed in ransomware campaigns like BQTLock.
Detects malicious persistence mechanisms using the Windows Task Scheduler, specifically targeting the creation or execution of 'TPMProfiler' or 'qemu-system-x86_64.exe' under high-privilege accounts (SYSTEM). This rule monitors for schtasks.exe task creation, anomalous parent-child process relationships involving task host processes, and unauthorized module loads of taskschd.dll associated with QEMU activity.
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
Detects network, DNS, and process-level activity associated with BQTLock ransomware command-and-control communication, specifically targeting Telegram Bot API and Discord webhook traffic originating from non-standard (non-browser/non-messaging) processes.
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects DLL sideloading behavior where a legitimate, signed executable (e.g., in System32 or Program Files) loads a DLL from a non-standard, user-writable directory (e.g., Temp, AppData, Downloads). This pattern is consistent with the delivery of Obsidian Sandstorm (Storm-2571) payloads such as ThrottleDrift, RiverGorilla, and SilverGorilla, where malicious DLLs are staged and loaded alongside trusted binaries.
Detects unauthorized modifications to Windows Registry Run and RunOnce keys where the configured value points to a file within a user-writable directory (e.g., Temp, AppData, Downloads) or uses rundll32.exe to execute a DLL. This behavior is indicative of persistence mechanisms used by Obsidian Sandstorm, such as sideloading binaries or launching malicious loaders from non-standard, writable locations.
Detects DLL sideloading activity where legitimate, signed binaries such as ADNotificationManager.exe or QEMU-related executables (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe) load malicious DLLs (e.g., vcruntime140_1.dll) from user-writable directories (e.g., AppData, Temp, ProgramData). This behavior is associated with the GOLD ENCOUNTER and STAC campaigns for delivering payloads like Havoc C2.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Page 610 of 1168