Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for the creation or modification of specific Windows Registry run keys. These keys are commonly used by malware and adversaries to achieve persistence, ensuring malicious code executes automatically upon system login. The rule specifically alerts on suspicious value names or paths associated with known threats or obfuscated file paths residing in common persistence directories.
Detects outbound network connections to common Tor relay and exit ports (9001, 9050) initiated by processes other than authorized Tor clients. This activity is often associated with threat actors, including Volt Typhoon, using Tor to obfuscate command-and-control (C2) traffic.
Detects instances where the Windows Subsystem for Linux (WSL) processes (wsl.exe or wslhost.exe) are spawned by suspicious parent processes, which may indicate an attempt to use WSL for payload execution or persistence on hosts where its usage is restricted or not authorized.
Detects wscript or cscript executing shell commands (del/delete) to remove .jse files. This pattern is commonly associated with malicious scripts attempting to clean up traces of their execution after running from temporary locations.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
Detects host reconnaissance and file discovery activities indicative of the MINIRECON implant, a tool linked to Mustang Panda campaigns. The rule monitors for the execution of common system enumeration and file searching commands triggered by the 'pct12bmp.exe' process, or in unauthorized contexts.
Detects reconnaissance and enumeration activities targeting Active Directory Web Services (ADWS) on port 9389. This includes specific detection of the SharpADWS tool and anomalous processes that connect to ADWS, a technique used to bypass standard LDAP monitoring by encapsulating AD queries within SOAP messages.
This rule detects Go-compiled backdoor binaries executing from suspicious, non-standard directories (e.g., ProgramData, AppData, Temp, Public) and initiating cmd.exe or powershell.exe for command execution. This behavior is consistent with the deployment and operational tactics of The Gentlemen RaaS group's custom Go-based malware.
Detects instances where VS Code (Code.exe) spawns interpreter processes (node, python, cmd, powershell, sh, bash) after opening a workspace containing a suspicious tasks.json file. This pattern is consistent with the abuse of VS Code task automation features to gain initial code execution, similar to campaigns targeting developers through malicious repository cloning.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Page 616 of 1168