Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,576 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.
Detects continuous command and control (C2) beaconing activity from Remote Monitoring and Management (RMM) tools over non-standard high ports. This rule identifies RMM processes (rmm, agent, client*.exe) establishing frequent network connections to remote IPs on ports greater than 1024, excluding common ports like 3389 (RDP), 8080, and 8443, indicating potential malicious use of RMM software for C2.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
Detects modifications to Windows Registry Run keys that specify paths associated with Remcos remote access tool (RAT) binaries. This behavior is used by the malware to achieve persistence by automatically launching the malicious process upon user logon.
Detects suspicious cross-process access or injection activity targeting Internet Explorer-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for high-privileged access rights, non-standard source process paths, and the presence of memory-related API calls often associated with process hollowing or injection (e.g., ZwCreateSection, VirtualAlloc, SetThreadContext) in combination with repeated access attempts.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Detects non-browser processes attempting to read or delete sensitive browser data files (e.g., Login Data, Cookies, Web Data, logins.json, cookies.sqlite) located in standard Windows browser paths. The rule specifically flags suspicious behavior involving file access and deletion patterns commonly associated with credential theft or 'browser-wiping' malware like Remcos.
Detects potential exploitation of CVE-2017-0199 where Microsoft Office applications (winword.exe or eqnedt32.exe) spawn suspicious child processes (mshta.exe, wscript.exe, cscript.exe, powershell.exe, or cmd.exe) often associated with malicious document-based payloads like Remcos RAT. The rule monitors for both process spawning patterns and command-line arguments indicative of remote payload retrieval.
Page 633 of 1168