Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
Detects malicious network discovery and enumeration activities associated with Akira ransomware. This includes the execution of SoftPerfect Network Scanner (netscan.exe) for port/service scanning and the use of the PowerView Invoke-ShareFinder module for identifying accessible network shares, often observed in post-compromise intrusion phases.
Detects log entries related to sensitive HR and financial data modifications, specifically identifying keywords such as 'Workday', 'direct deposit', 'payment election', or 'bank account' changes. This activity is indicative of potential payroll fraud, where an adversary attempts to redirect employee compensation to an unauthorized account.
Detects instances where wscript.exe or cscript.exe spawn a hidden PowerShell process that includes '-decode' arguments targeting files within the C:\ProgramData directory. This pattern is characteristic of the Kimsuky threat group, specifically the NUKESPED JSE loader, which uses Windows Script Host to execute staged, base64-encoded payloads.
Detects anomalous network connection enumeration activities associated with JFMBackdoor, where a DLL sideloaded into the legitimate Windows fltMC.exe utility spawns netstat.exe to perform discovery of active network connections on the compromised system.
Detects the Windows Filter Manager utility (fltMC.exe) executing from a temporary directory (e.g., %TEMP% or %AppData%\Local\Temp) in an unusual manner. This behavior is consistent with the JFMBackdoor malware used by Red Lamassu to achieve reflective DLL loading of malicious payloads directly in memory, bypassing traditional disk-based execution methods.
Detects the creation of suspicious file types (.exe, .dll, .ps1, etc.) in common staging directories (e.g., C:\Users\Public, C:\Windows\Temp) by the DllHost.exe process. The rule filters out known-good COM surrogate CLSIDs but flags instances where DllHost.exe is launched without a /Processid argument (potential WSL2 proxy activity) or with an unrecognized CLSID, suggesting potential COM hijacking or file staging.
Detects potential path traversal attempts in web server and gateway logs, specifically targeting URL parameters like 'url' or 'path'. The rule identifies suspicious URI sequences (e.g., dot-dot-slash) followed by large HTTP responses, which may indicate successful file retrieval or sensitive data access.
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
This rule detects attempts to exfiltrate GCP service account credentials by performing a Server-Side Request Forgery (SSRF) attack targeting the GCP metadata server or local system files. It correlates suspicious outbound request patterns with subsequent response bodies containing standard GCP credential fields, excluding known legitimate authentication traffic to cloud APIs.
Page 683 of 1168