Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,576 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.
Detects file and directory hiding techniques associated with Mustang Panda implants (e.g., SHARDLOADER, ZOHOMURK) by monitoring for the usage of 'attrib.exe' to set the hidden (+h) attribute, or the usage of 'icacls.exe' to manipulate access permissions within sensitive directories like ProgramData or AppData, which may be indicative of malicious artifact concealment.
Detects malicious attempts to clear Windows Event Logs using native utilities like wevtutil or PowerShell, or by direct file deletion of .evtx files. This behavior is common in post-exploitation cleanup phases by threat actors, such as The Gentlemen RaaS, to hinder incident response and forensic analysis.
Detects attempts to clear Windows Event Logs via common administrative tools such as 'wevtutil.exe', PowerShell, or the detection of specific system events indicating logs have been cleared (Event IDs 1102 and 104).
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
Detects the creation or modification of common log file types (e.g., .log, .txt, .dat, .kl) by unsigned, non-standard processes executing from high-risk directories like AppData, Temp, or ProgramData. This behavior is indicative of potential keylogging activities associated with remote access trojans (RATs) such as Atlas RAT or ValleyRAT.
This rule monitors for the execution of common remote access and support tools (AnyDesk, TeamViewer, ScreenConnect, QuickAssist) that originate from suspicious file paths (e.g., Temp, AppData, Downloads) or are launched with silent installation flags, or appear to be installed via msiexec by non-standard parent processes. These behaviors are common indicators of adversaries attempting to establish unauthorized persistent remote access or deploying remote support tools as part of a post-exploitation activity.
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
This rule detects multiple behavioral indicators associated with malware deployment, including PyInstaller environment artifacts, reconnaissance via system utilities (wmic, tasklist), and suspicious process hollowing/stager chains (e.g., mshta/wscript/cscript invoking PowerShell followed by payload execution from temporary directories). These behaviors are often associated with loaders like BQTLock and Remcos.
This rule detects multi-stage behavior associated with the BQTLock ransomware, including C2 network communication, execution of loaders (PyInstaller-based) from common writable directories, suspicious child process spawning, unauthorized OpenSSH service usage potentially indicating privilege escalation, and mass file encryption indicated by both specific file extensions and bulk rename heuristics.
Page 629 of 1168