Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,584 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential keylogging activity by identifying either low-level Windows keyboard hooks initiated by suspicious processes or the creation of suspicious log files in user-writable directories by unsigned processes. It filters out common, trusted browser processes and signed Microsoft binaries to reduce noise.
This rule monitors for a combination of suspicious behaviors including C2 network activity to known malicious IPs, potential credential theft targeting browser data files, suspicious library loading (such as keyloggers or potential sideloading) from temp or appdata directories, and beaconing activity using non-standard or suspicious processes. The rule calculates a risk score based on the number and type of indicators observed on a single host.
Detects the repeated creation of text or log files in common temporary staging directories (TEMP, APPDATA) by non-standard processes. This behavior is indicative of malware, such as Atlas RAT or Gh0stRAT, periodically flushing captured keystrokes to a file before staging for exfiltration.
Detects the loading of the avicap32.dll library (a legacy Windows Multimedia API used for webcam capture) by processes other than recognized media or conferencing applications. This is a common indicator of RATs (such as Atlas RAT or Gh0stRAT) attempting to clandestinely record video or audio from the victim's device.
Detects evidence of malware, specifically TA4922 (Atlas RAT, RomulusLoader), attempting to evade sandbox or virtualization environments. The detection monitors process command lines for WMI queries or registry artifact paths related to known hypervisor technologies such as VMware, VirtualBox, and QEMU. It requires multiple occurrences within a 5-minute window to reduce potential noise.
Detects the execution of remote monitoring and management (RMM) binaries AnyDesk or SyncFuture when launched by suspicious parent processes commonly associated with phishing delivery chains (e.g., mshta, wscript, cmd, powershell), or when executed from user-writable directories like Temp or AppData, which is a common pattern for persistent remote access abuse.
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
Detects execution patterns associated with the BQTLock ransomware, specifically the PyInstaller-packaged 'start.exe' binary acting as a loader to spawn 'BQT.exe' or other child processes, identified by specific PyInstaller environment artifacts in the command line.
This rule detects the BQTlock ransomware behavior of capturing desktop screenshots using suspected malicious processes ('BQT.exe', 'start.exe') and attempting to exfiltrate the captured data via the Telegram API using 'sendPhoto' or 'sendDocument' commands.
Detects command-line activity searching for, accessing, or displaying sensitive credential and configuration files on Linux systems, such as AWS credentials, Kubernetes configurations, Docker settings, or application API keys. This behavior is indicative of credential theft or discovery attempts.
Page 675 of 1168