Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of known remote access tools (e.g., AnyDesk, SyncFuture) or processes originating from common user-writable directories (AppData, Temp, Local) that subsequently spawn other processes within these same user-writable directories. This pattern is commonly observed in malware staging or the misuse of remote support tools for unauthorized access.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
Detects potential privilege escalation activity including manual privilege discovery using 'whoami /priv', suspicious elevated processes spawned from non-elevated parents, and specific scheduled task execution patterns associated with Payouts King malware.
Detects the use of native Windows administration and system tools commonly used for reconnaissance and discovery of running processes, domain controllers, and system configuration.
Detects execution of Windows remote assistance tools like Quick Assist, msrdcw, or msra when spawned by unexpected parent processes, or when spawned by Microsoft Teams. This behavior may indicate an adversary abusing legitimate remote access software to maintain persistence, conduct lateral movement, or gain interactive access to a compromised system.
Detects the loading of unsigned .dll or .ocx modules from non-standard, potentially user-writable directories such as AppData, Temp, or ProgramData. This behavior is frequently associated with persistence mechanisms or side-loading techniques.
Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.
Detects the execution of various suspicious file types (executable, scripts, shortcuts) from common Windows temporary directories (AppData\Local\Temp and Windows\Temp). The rule excludes common installers and binaries signed by reputable software publishers to reduce noise.
Page 674 of 1168