Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
Detects potential surveillance activity by monitoring for screenshot image files written to suspicious directories (such as Temp or AppData) by non-whitelisted processes, and identifies unauthorized access to camera or video capture devices by processes that are not standard conferencing or imaging software. This rule is designed to detect capabilities often associated with Remote Access Trojans (RATs) such as AtlasRAT and ValleyRAT.
Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.
Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
Detects the use of common archive utilities (7zip, WinRAR, zip) to interact with files located in suspicious directories commonly used for data staging (AppData, Temp, Users Public). The rule tracks multiple occurrences of these commands by the same user on a host to identify potentially malicious collection and staging activities before exfiltration.
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Detects the execution of wmic.exe with specific WMI queries (Win32_ComputerSystem, Win32_PhysicalMedia, Win32_PnPEntity) commonly used for system profiling and hardware discovery by threat actors like TA4922. The rule assigns a higher risk score when the process is launched from potentially suspicious locations such as user-writable or temporary directories.
This rule detects potentially malicious activity related to Group Policy Object (GPO) manipulation, including the execution of the SharpGPOAbuse tool and suspicious PowerShell commands intended to modify GPOs for persistence or privilege escalation, such as adding local administrators, creating immediate tasks, or applying domain-level policies.
This rule monitors for new user account creation (Event ID 4720) that is either performed by a known suspicious process name or initiated by a non-standard provisioning account. It additionally correlates these creation events with subsequent additions of the new account to the local Administrators group (Event ID 4732) to flag potential privilege escalation attempts.
Page 646 of 1168