Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,335 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects post-compromise activity associated with the NeedyMantis group, specifically the staging of a legitimate binary alongside a malicious DLL and a paired archive, followed by the execution of the legitimate binary to trigger DLL side-loading. This activity is typically preceded by Impacket-style remote command execution (e.g., wmiexec, smbexec, atexec).
Detects Android malware attempting to abuse accessibility services or system settings to enable wireless debugging and spawn an ADB shell with elevated privileges. This behavior is indicative of unauthorized control over the device via Android Debug Bridge (ADB).
Detects specific HTTP traffic patterns associated with the RatHat malware's FRP (Fast Reverse Proxy) reverse-tunneling deployment and C2 status reporting. The rule identifies the sequence of fetching configuration, initiating WebSocket tunnel links, and reporting deployment status to a remote command-and-control server.
Detects the creation of Windows services that reference file paths often associated with NeedyMantis malware sideloading activities. These paths typically involve directories inside ProgramData or ProgramFiles where benign executables are used to sideload malicious DLLs.
Detects the first-stage loader DLL associated with the NeedyMantis actor, which masquerades as the WinSparkle.dll component used in Poedit software. This rule uses a specific SHA256 file hash to identify this malicious component.
Detects the execution of a specific, tampered version (12.5.1) of the DAEMON Tools Lite installer, which has been identified as a distribution vector for malicious activity linked to Storm-3069.
Detects HTTP traffic from the Psychedelic Stealer malware as it exfiltrates stolen browser passwords and session tokens to a specific command-and-control endpoint, and identifies the staging of Chromium Web Data files ('wd_tmp.db') within HTTP POST requests.
Detects outbound network traffic to known public BNB Smart Chain (BSC) data seed nodes using JSON-RPC 'eth_call' methods or TLS connections. This pattern is indicative of malware using blockchain infrastructure as a dead drop resolver for C2 command retrieval or configuration updates.
Detects instances where an unexpected process loads both 'amsi.dll' and .NET runtime modules ('clr.dll' or 'mscoree.dll'). This behavior is frequently associated with malicious, position-independent shellcode that attempts to disable AMSI scanning and host the CLR in-memory to execute malicious .NET assemblies or payloads, avoiding standard .NET execution environments like PowerShell or msbuild.exe.
Detects execution of various reconnaissance commands commonly used by Remote Access Trojans (RATs) to profile a target host. This includes querying security product status (AV/Defender), enumerating domain controllers, network adapters, port scanning, and gathering system hardware and software inventory.
Page 66 of 1168