Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for Cobalt Strike Beacon named pipe C2 patterns by analyzing Sysmon event IDs 17 (Pipe Created) and 18 (Pipe Connected). It specifically flags known default Cobalt Strike pipe naming conventions (e.g., 'MSSE-', 'postex_ssh_', 'msagent_') and common randomized short alphanumeric pipe names while excluding legitimate Windows system pipes.
Detects the abuse of msiexec.exe to execute malicious payloads, a technique observed in the StrikeShark campaign. The rule identifies suspicious child processes, installation from remote sources (UNC/HTTP), execution from non-standard user-writable directories (Temp, AppData), and the use of quiet installation flags to mask malicious activity.
Detects network activity over port 1313 containing Socket.IO payloads with keywords 'control' and 'escape', indicative of a command and control or remote access channel often associated with interactive shells or administrative backdoors.
This rule monitors for credential dumping activities by identifying the execution of Mimikatz, the use of command-line arguments specific to Mimikatz (e.g., 'sekurlsa'), or unauthorized processes attempting to access the Local Security Authority Subsystem Service (LSASS) process.
Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.
This rule detects interactive RDP logons (Logon Type 10) on Windows systems. While RDP is a legitimate remote administration tool, it is frequently abused by adversaries following credential theft to move laterally within a network.
Detects outbound HTTP POST requests to dynv6 dynamic DNS providers containing specific multipart form data patterns, including filenames like 'Info.txt', indicative of data exfiltration by the Kimsuky threat group using custom C2 staging scripts.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window style, or specific payload strings like 'MiniJunk') originating from common file staging directories (e.g., Downloads, Temp, AppData). This pattern is often indicative of malicious post-lure payload execution.
Detects the creation of scheduled tasks using the Windows schtasks utility where the task action points to a file located in common user-writable directories such as AppData, Temp, Users\Public, or Downloads. This behavior is frequently associated with persistence mechanisms used by malware and backdoors.
Detects scenarios where an executable (.exe) or installer (.msi) is launched from a staging or temporary directory (e.g., Temp, Downloads) and subsequently deleted within 5 minutes. This behavior is indicative of malware or adversary tools cleaning up their own footprints after execution.
Page 622 of 1168