Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for potential DLL sideloading by detecting specific known executable names loading suspicious modules such as 'dtlcrashcatch.dll' or 'setupui.dll'. It further validates the suspicion by analyzing command-line arguments for sideloading indicators (e.g., '-uidll', '/appmodel') or high-entropy arguments, and checking if the loaded module resides in the same directory as the host process, which is a common pattern for DLL sideloading.
Detects the execution of ConfigurationRemotingServer.exe initiated by the Winget package manager. This activity is associated with applying system or application configuration files (e.g., .yaml configuration files) via the Windows Package Manager 'winget configure' command.
This rule detects the execution of ConfigurationRemotingServer.exe, which is the backend process used by the Windows Package Manager (winget) when applying configuration files. The detection specifically monitors for this process being spawned by winget.exe with flags indicating the acceptance of configuration agreements and the execution of a configuration command.
Detects outbound network connections to the domain 'financemachinelearning.com' from any host. This domain may be associated with suspicious activity or command and control infrastructure.
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects suspicious inter-process communication via named pipes and cross-process thread injection targeting known sideloading host processes, specifically associated with the SPECTRALVIPER threat activity.
Detects the modification or creation of Pluggable Authentication Module (PAM) files or shared libraries in Linux environments. This technique is often used to establish persistence or intercept authentication credentials by replacing legitimate modules like pam_unix.so with malicious counterparts.
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
Page 679 of 1168