Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.
Detects the abuse of msiexec.exe to perform suspicious actions such as fetching payloads from remote URLs, UNC paths, or loading from user-writable directories (e.g., AppData, Temp, ProgramData). The rule further correlates this with msiexec spawning suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which is indicative of malicious post-exploitation activity.
Detects the modification of registry keys within the Active Setup 'Installed Components' path, specifically targeting keys named '{RAGE-MASTER}'. The rule flags the creation or modification of a 'StubPath' value or any value containing 'win_guard_' or 'RageCore_', which are typical indicators of persistence mechanisms used by malware to execute code upon user logon.
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
Detects anomalous surveillance-like behavior on Android devices associated with the APT36 Ghazwa spyware. The rule identifies applications that check more than 8 distinct sensitive Android permissions within a 60-second window, followed immediately by an outbound HTTP/HTTPS POST request to an external IP, indicative of spyware pre-staging and data exfiltration.
This rule detects the use of 7za.exe to extract specific files (data2.bin) from an archive using a hardcoded password while located within an Avast Software directory. This behavior is indicative of potential malicious activity involving the tampering or extraction of security software components or data.
Detects the execution of Control Panel (.cpl) files using rundll32.exe or dllhost.exe. Adversaries frequently use these system binaries to proxy the execution of malicious payloads, as .cpl files are technically DLLs that export CPlApplet functions and can bypass certain application allowlisting restrictions.
Detects the use of 7-Zip (7z.exe) executed via the command-line interpreter (cmd.exe) to interact with a specific data file named 'data.dat' associated with the 'Traiolx Custom Utils' project, which may indicate data staging or archival activities performed by an adversary.
Detects process execution patterns associated with the LegionLoader malware staging area ('Traiolx Custom Utils'). It monitors for unsigned processes launched from this directory or processes spawned by common loaders like msiexec.exe, cmd.exe, or dllhost.exe that exhibit artifacts linked to the malware's anti-debugging and infection routines.
This rule detects exploitation attempts against Microsoft 365 Copilot (CVE-2026-42824) where attackers inject HTML or malicious prompt sequences into the 'q' query parameter. These payloads aim to perform prompt injection, SSRF via Bing, and cross-site scripting to exfiltrate sensitive data such as mailbox content and MFA tokens.
Page 665 of 1168