Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious bulk archiving activity or file drops of archive formats in staging directories. The rule monitors for common archival utilities (7zip, WinRAR) or PowerShell's Compress-Archive command being used, or the creation of archive files in suspicious paths (e.g., Temp, AppData, Public). It alerts when high volumes of archives are created, password-protected archives are used, or rapid archival operations are performed.
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects execution of PowerShell commands associated with the Pay2Key ransomware, specifically searching for command lines that reference bin-staged payloads (data1.bin, data2.bin, data3.bin) and a hardcoded XOR key (12199) used to deobfuscate the payloads in memory before execution via Invoke-Expression or similar methods.
Detects DNS queries to Gofile infrastructure originating from processes executing from typically transient directories (AppData or Temp). This behavior is characteristic of VILE ransomware, which stages compressed user files in these directories before exfiltrating them via Gofile as part of a double-extortion strategy.
Detects instances where a Node.js process (invoked via npm) spawns suspicious secondary processes such as shell interpreters (cmd, powershell, sh, bash) or network utilities (curl, wget). This pattern is often indicative of malicious npm lifecycle scripts (e.g., preinstall, postinstall) attempting to perform system reconnaissance or download secondary payloads.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
This rule detects various User Account Control (UAC) bypass techniques (such as fodhelper.exe or eventvwr.exe hijacking), registry modifications involving 'ms-settings' classes, and the use of 'Start-Process -Verb RunAs' to request administrative privileges. It also flags potentially elevated installations of OpenSSH or Tailscale, which are commonly targeted by attackers following privilege escalation.
Detects various methods of anti-forensics activity commonly used to hide attacker presence, including clearing Windows Event Logs via wevtutil or PowerShell, deleting the USN Journal via fsutil, and bulk file deletion using command-line utilities.
Detects node.exe spawning cmd.exe or powershell.exe during npm package installation process, indicating potential malicious use of preinstall or postinstall scripts. This pattern has been observed in supply chain attacks involving infostealers like Miasma and MYRA.
Page 649 of 1168