Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors process execution events for the presence of known penetration testing and post-exploitation tools, specifically NetExec (formerly CrackMapExec), nxc, or cme. These tools are frequently used by adversaries for network discovery, lateral movement, and credential harvesting within Active Directory environments.
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
Detects signs of persistence via account manipulation consistent with the Obsidian Sandstorm actor. The rule monitors for unauthorized password resets on administrative accounts (Event IDs 4723, 4724), the addition of users to highly privileged security groups (Event IDs 4728, 4732), and modifications to user account attributes (Event ID 4738) that indicate changes in account control flags.
Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.
This rule detects the execution of rclone.exe with command-line arguments indicative of data exfiltration to cloud storage providers (mega.nz, Dropbox, OneDrive) or via SFTP. This behavior is commonly associated with ransomware threat actors, such as those observed in the STAC4713 and STAC3725 campaigns (GOLD ENCOUNTER), who utilize rclone to stage and exfiltrate sensitive data prior to deploying ransomware.
Detects the BQTLock ransomware distribution chain, where a PyInstaller-packaged loader executable (start.exe) is used to unpack and spawn the primary BQT.exe ransomware payload. The detection monitors for process creation events where start.exe exhibits typical PyInstaller command-line artifacts (e.g., _MEIPASS) and initiates BQT.exe, which is associated with malicious activities including UAC bypass and file encryption.
Detects the UAC bypass technique employed by the BQTLock ransomware, where the registry key 'HKCU\Software\Classes\mscfile\shell\open\command' is hijacked to execute arbitrary binaries such as BQT.exe or malicious scripts via eventvwr.exe, effectively elevating privileges.
Detects the BQTLock (BaqiyatLock) ransomware executing various system and network discovery commands such as systeminfo, ipconfig, and whoami from its main process (BQT.exe). These actions are indicative of pre-encryption reconnaissance used to profile the host environment before malicious file encryption commences.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.
Page 630 of 1168