Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,582 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.
Detects bulk file permission changes using native Windows utilities like icacls, cacls, or takeown. The rule flags instances where non-Microsoft signed processes execute these commands repeatedly (more than 5 times) within a short window, which is often indicative of automated privilege escalation or an attempt to weaken file access controls across a system.
This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.
Detects a suspicious execution chain where a dropper (chrome_setup.exe) uses an AppDomainManager injection technique to load a malicious DLL, followed by the execution of the TinyRCT payload (PerfWatson2.exe) from the LocalAppData directory. This behavior has been observed in campaigns targeting Southeast Asian government and critical infrastructure.
Detects suspicious process execution patterns where VS Code (code.exe) spawns interpreter processes (node.exe, python.exe) followed by network connections to known staging infrastructure (e.g., jsonkeeper.com, vercel.app). This behavior is characteristic of the 'Contagious Interview' campaign attributed to the Lazarus Group, used to deploy BeaverTail and InvisibleFerret malware following social engineering lures.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
This rule detects the creation of scheduled tasks that point to executable files located in suspicious directories such as ProgramData, Temp, or AppData. This behavior is indicative of persistence mechanisms commonly employed by the The Gentlemen Ransomware-as-a-Service (RaaS) group to maintain access and execute malicious components like backdoors or ransomware binaries.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
This rule detects when package management tools like npm or go get spawn suspicious child processes, such as interpreters (python, powershell, cmd, bash) or utility binaries (mshta, wscript), during the installation lifecycle. This behavior is indicative of malicious code execution triggered by compromised or hijacked software packages.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
Page 670 of 1168