Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
Detects activity associated with the SPECTRALVIPER malware loader, specifically identifying known malicious file hashes (system.config.xml, NotificationConfig.json) and cross-process memory injection patterns (RemoteMemoryAllocation, RemoteMemoryWrite, CreateRemoteThreadApiCall) initiated by specific suspect processes.
Detects the creation of local user accounts or adding users to privileged groups triggered by ConfigurationRemotingServer.exe. This activity is indicative of potential misuse of the WinGet DSC (Desired State Configuration) capability to maintain persistence or escalate privileges on a Windows host, a technique observed in the DSCourier malware.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Detects OneDrive synchronization service processes or associated modules invoking suspicious token manipulation or privilege enumeration APIs, such as 'StealToken', 'Impersonate_ThisThread', or 'GetPrivileges'. This behavior is indicative of potential privilege escalation or process injection techniques disguised within legitimate cloud sync service processes.
This rule detects network communication with known malicious command-and-control (C2) infrastructure identified by specific domains and IP addresses. The detection logic calculates a confidence score based on the presence of identified malicious C2 domains or IPs, specific suspicious cookies (zd_cs_pm, euconsent-v2), and known C2 URI paths.
This rule detects the execution of account management commands such as user creation or group member modification initiated by or originating from 'ConfigurationRemotingServer.exe'. It also monitors for subsequent Windows Security Event IDs 4720 (User Account Created) and 4732 (Member added to local group) specifically targeting the 'Administrators' group, which indicates potential unauthorized administrative account or group membership manipulation.
This rule detects suspicious child process creation originating from 'setup.exe' (specifically with 'metakit' arguments) or 'IntelAudioService.exe' (specifically with sideloading-related arguments like '/appmodel', '/StateRepository', and '/Service'). These indicators are commonly associated with the SPECTRALVIPER threat activity, where legitimate-looking processes are abused to launch secondary, potentially malicious tools like cmd, powershell, or other system utilities.
This rule detects the execution of ConfigurationRemotingServer.exe when spawned by unexpected parent processes, such as winget.exe, WindowsPackageManagerServer.exe, or DSCourier.exe. These processes are associated with Desired State Configuration (DSC) and package management, and their use to launch ConfigurationRemotingServer.exe in certain contexts may indicate exploitation of DSC features to execute unauthorized configurations or commands.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Page 652 of 1168