Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of native Windows utilities (vssadmin, wmic, bcdedit) used to inhibit system recovery or modify boot configuration, such as deleting shadow copies or disabling recovery features. The rule further flags these actions when executed by suspicious parent processes, processes outside of standard system paths, or via WMI/DCOM interfaces frequently associated with ransomware and lateral movement.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
Detects potential malicious activity where a process enumerates installed software by querying the Windows Uninstall registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall) for application details such as DisplayName, Publisher, and UninstallString. This pattern is characteristic of Remcos RAT's 'ListInstalledApplications' capability to perform reconnaissance on a compromised host.
Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.
This rule detects the use of 'reg.exe' to disable User Account Control (UAC) by setting the 'EnableLUA' registry key to '0'. This action is a common technique used by malware, such as the Remcos RAT, or by adversaries attempting to persist with elevated privileges by weakening Windows security controls.
Detects instances where the OpenVPN Connect process spawns unexpected child processes. This behavior is consistent with the exploitation of OpenVPN ACE (Access Control Exploitation) vulnerabilities, where a malicious OpenVPN server pushes an 'echo' directive that decodes to a command and executes upon disconnection, bypassing client-side script execution restrictions.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
This rule detects network connections on non-standard ports (2404, 4782) that are commonly associated with the Remcos Remote Access Trojan (RAT). It monitors outbound connections from suspicious process names or paths, such as those found in ProgramData, AppData, or Temp directories, and filters out internal RFC-1918 traffic.
Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.
Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.
Page 656 of 1168