Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the deletion or renaming of .jse (JScript Encoded) files by the Windows script hosts wscript.exe or cscript.exe. This activity is often associated with the cleanup of obfuscated scripts after they have been executed as part of a malicious campaign.
Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.
Detects process enumeration activities (tasklist.exe or ps.exe) when executed by or on behalf of fltMC.exe, which is known to be associated with JFMBackdoor sideloading techniques. The rule monitors both direct child processes and descendants of the suspicious process.
Detects registry modifications (get, set, delete, rename) performed by the Filter Manager utility (fltMC.exe) targeting common Windows software and class registry keys. While fltMC is a legitimate Windows utility for managing filter drivers, its interaction with these specific registry hives is highly suspicious and may indicate unauthorized persistence or configuration tampering.
Detects file creation or renaming events associated with JFMBackdoor, including unauthorized file manipulation in common system locations and the presence of known backdoor component filenames. It also monitors for suspicious file attribute manipulation performed by processes running from temporary directories.
Detects evidence of file deletion activity associated with the Kimsuky NUKESPED loader chain. The rule monitors for the execution of 'del' commands via cmd.exe initiated by script interpreters (wscript.exe, powershell.exe) to remove malicious artifacts such as .jse, .a9oc files, or specific executable names like zlrenu8.exe from the system, characteristic of post-exploitation cleanup.
Detects outbound network connections to Fastly CDN IP ranges originating from suspicious file paths (Temp or ProgramData) or common LOLBins (wscript.exe, powershell.exe) often utilized by the Kimsuky threat group for NUKESPED backdoor C2 communication.
Detects the execution of known Living-off-the-Land (LotL) binaries (e.g., powershell.exe, certutil.exe, mshta.exe) where the parent or initiating process is the Windows Subsystem for Linux (WSL2) wsl.exe binary. This pattern indicates potential abuse of WSL2 interop features to execute Windows-native binaries from a Linux environment, often used to bypass traditional host-based monitoring or security controls.
Detects attempts to bypass URL validation and access sensitive GCP metadata endpoints (169.254.169.254 or metadata.google.internal) using a double-slash (//) prefix injection pattern within URL parameters. This technique is often used in Server-Side Request Forgery (SSRF) attacks to read local resources or metadata credentials from Cloud Run or other GCP compute services.
Detects the execution of short-named executable binaries from common staging directories (Users\Public, Windows\Temp, ProgramData) where the parent process is DllHost.exe, explorer.exe, or cmd.exe. This pattern is indicative of WSL2 being used to stage and execute payloads, where DllHost.exe is leveraged to proxy file operations from the WSL2 environment to the Windows host, potentially bypassing certain security controls.
Page 654 of 1168