Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the loading of DLLs by rundll32.exe from non-standard user-writable directories (AppData, Temp), often associated with infostealer clipper plugins such as clip64.dll. These patterns are commonly used by malware families like Amadey, LokiBot, and Lumma Stealer to maintain persistence or execute malicious functionality via legitimate Windows binaries.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with the '-o' flag to output to a .zip file from an HTTP/HTTPS URL, and then correlates this with a file creation event for a .zip file on the same device.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
Detects the creation of web-executable files (e.g., .aspx, .ashx, .php, .jsp, .asmx) within sensitive web root directories (IIS, Exchange, SharePoint) when the writing process is identified as an IIS worker process (w3wp.exe) or an Exchange Unified Messaging worker process (UMWorkerProcess.exe). This activity is highly indicative of web shell deployment for post-exploitation persistence, commonly associated with vulnerabilities like CVE-2021-26855 or CVE-2022-41082.
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
Detects registry modifications to the 'Debugger' value for Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique, known as IFEO (Image File Execution Options) hijacking, allows an adversary to redirect the execution of these binaries to a malicious payload. This is a common persistence mechanism used by malware, including TrymeLocker, to achieve unauthorized access or privilege escalation at the login screen.
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
This rule detects when a signed process loads a DLL file from common user-writable directories (AppData, ProgramData, Public, Downloads). It further filters by verifying that the DLL is located in the same directory path tier as the executing process, which is a common indicator of side-loading or DLL hijacking activity where an attacker places a malicious DLL alongside a legitimate executable.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Page 634 of 1168