Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.
Detects the creation of a scheduled task where the action references an executable file located in common user-writable directories (ProgramData, AppData, Users\Public, or Temp) shortly after that file was created on the disk. This pattern is characteristic of persistence mechanisms used by threat actors associated with Operation Turb00, such as the Wingo or HijackLoader malware families, which use scheduled tasks to maintain persistence via dropped binaries.
Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.
Detects the creation of a Windows Registry Run key that points to an executable named 'ssh-add.exe' located in 'C:\ProgramData\Google Update'. This behavior is associated with the ResiLoader malware, which uses this technique for persistence by masquerading as a legitimate Google update process.
Detects the use of rundll32.exe to execute the 'ExecuteTask' function from a specific DLL (agt.dll) located in C:\ProgramData\CorsairUtil\. This activity is consistent with proxy-execution techniques used by Vidar/HijackLoader variants to execute malicious payloads, often triggered by a dropped loader executable.
Detects network connections to known Telegram or Steam community profile pages used by the Vidar information stealer as dead-drop resolvers to retrieve secondary C2 infrastructure. The rule specifically filters for non-browser processes to reduce noise from legitimate user traffic.
Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.
Detects instances where a process not typically associated with web browsing performs a DNS request for Telegram (telegram.me) or Steam Community (steamcommunity.com) domains, potentially indicating command and control (C2) or unauthorized data exfiltration activity.
Smbexec Lateral Movement
YARA-L
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
Page 635 of 1168