Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects a sequence of events where a host initiates a network connection on port 1313 (a common port associated with certain web-based C2 or exploitation frameworks) followed shortly by an outbound network connection initiated by PowerShell within a 5-minute window. This behavior is indicative of a post-exploitation phase where an initial entry point leverages a malicious script or shell to establish persistent communication.
Detects the execution of wscript.exe as a child process of hh.exe (the Microsoft HTML Help executable). This behavior is often associated with the execution of malicious scripts embedded within CHM files, which is a common technique for bypassing security controls and executing arbitrary code.
Detects instances where the WinRAR archive utility spawns a PowerShell process with command-line arguments typically associated with obfuscated or fileless execution. The detection specifically flags PowerShell commands that employ techniques such as base64 encoding, execution policy bypass, hidden window styles, or commands containing indicators of in-memory process manipulation such as NtAllocateVirtualMemory or memory allocation constants.
This rule detects unauthorized or unauthenticated WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. The detection looks for specific URL patterns characteristic of the Socket.IO protocol (EIO=4, transport=websocket) that indicate an attempt to establish a connection with the vulnerable service without proper credential exchange.
Detects the use of PowerShell to read files from the C:\ProgramData directory using the -Raw parameter, followed by the execution of the content via Invoke-Expression (iex). This pattern is often used to execute obfuscated payloads stored in non-standard locations while bypassing basic execution constraints.
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
Detects suspicious file activity associated with the GIFTEDCROOK (UAC-0226) threat actor. The rule identifies the creation of randomized staging directories under the user profile, the creation of ZIP archives in the user root, and the creation of extensionless files within the Windows TEMP directory.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
This rule monitors for processes attempting to enumerate sensitive environment variables related to cloud services (AWS) and AI platforms (Anthropic), or access specific configuration and credential files (e.g., .aws/credentials, .config/anthropic). It specifically correlates these behaviors with potentially suspicious parent processes like bash, node, or python interpreters, which may indicate an AI agent or a reverse shell performing reconnaissance or credential exfiltration.
Page 660 of 1168