Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,578 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.
Detects the execution of SharpGPOAbuse for malicious Group Policy Object (GPO) manipulation, specifically identifying characteristic command-line arguments used for task creation and modification. The rule also monitors for subsequent forced GPO updates via net.exe or net1.exe, often associated with post-exploitation activities in the StrikeShark campaign.
Detects the BQT/start.exe loader exhibiting suspicious behavior indicative of sandbox or analysis environment evasion, including checking for common analysis tools, enumerating processes, or querying the registry for VMware-related artifacts.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
Detects the execution of QEMU binary processes with command-line arguments targeting database or virtual disk files (e.g., .qcow2, .db) or matching known malicious file hashes. This behavior is indicative of unauthorized use of virtualization tools to execute payloads, conduct forensics, or manipulate virtual disk images in an environment.
Detects the loading of user32.dll or ntdll.dll by processes running from suspicious, user-writable directories (e.g., AppData, Temp, Public). This pattern is consistent with TA4922 Atlas RAT and other implants attempting to install keyboard hooks for input capture via SetWindowsHookEx or GetAsyncKeyState.
Detects activity associated with the TA4922 (Silver Fox) threat actor, specifically involving Atlas RAT and RomulusLoader. The detection logic utilizes four primary telemetry sources: network connections to known C2 IP addresses, DNS queries for the 'srt.tw' domain, suspicious outbound connections from user-writable directories (AppData, Temp, etc.) over non-standard ports, and the execution of a specific malicious ZIP archive file identified by its SHA256 hash.
Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.
Detects BQTLock (BaqiyatLock) ransomware activities involving the exfiltration of stolen data, credentials, or infection reports. The rule identifies suspicious outbound network connections to known C2-enabling web services (Telegram Bot API and Discord webhooks) initiated by the BQT.exe or start.exe processes, which are typical indicators of this ransomware variant.
This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.
Page 648 of 1168