Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects the use of the IIS command-line utility (appcmd.exe) to disable HTTP logging for an IIS site. Attackers may disable logging to conceal post-exploitation activities or unauthorized access attempts from forensic analysis and security monitoring.
Detects reconnaissance activity targeting Active Directory infrastructure using common discovery tools such as AdFind, BloodHound/SharpHound, dsquery, nltest, and native net commands. The rule identifies suspicious patterns by correlating multiple executions or flagging the use of known adversarial enumeration binaries, monitoring for commands that specifically target domain domain-wide information, trust relationships, or domain groups.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, including real-time monitoring, behavior monitoring, and antispyware features, or attempts to stop/disable the WinDefend service.
Detects instances where an IIS worker process (w3wp.exe) spawns common Windows OS enumeration tools or commands (whoami, cmd.exe, net.exe, etc.). This behavior is a common indicator of post-exploitation activity, typically involving the use of a web shell on an IIS or ColdFusion web server.
Detects unauthorized processes attempting to read sensitive browser credential files (Login Data, Cookies, Web Data) from Chrome, Edge, and similar browsers, which is a common post-compromise technique used by infostealer malware to exfiltrate session cookies and stored credentials.
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects the execution of known Active Directory enumeration tools (BloodHound/SharpHound, AdFind) and command-line techniques (net group /domain, PowerView cmdlets) that are frequently associated with reconnaissance activities by threat actors like Akira affiliates, particularly when initiated from non-standard or unmanaged endpoints.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Page 662 of 1168