Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of wusvc.exe (Windows Update Service) from suspicious locations such as Downloads or Temp folders with high integrity level, which is characteristic of masquerading techniques used by adversaries to hide malicious activity as a legitimate system process.
Detects modifications to the 'Shell' or 'Userinit' values within the 'Winlogon' registry key, excluding the default 'explorer.exe' value. Attackers often modify these keys to gain persistence by executing malicious binaries automatically when a user logs in.
This rule detects bulk execution (5+ events within 60 seconds) of Windows system utilities icacls, cacls, and takeown. These tools are commonly used by adversaries to modify file or directory permissions (DACLs) to gain access to protected files or maintain persistence. The rule specifically monitors for common patterns used to grant access to sensitive users (e.g., Everyone, Administrators) or interaction with critical system paths.
Detects the execution of known diagnostic, debugging, or analysis tools (such as IDA Pro, Process Hacker, Wireshark, etc.) by processes other than standard Windows system processes. This behavior may indicate an adversary conducting reconnaissance, attempting to bypass protections, or analyzing system artifacts.
This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.
Detects the SNOWLIGHT dropper (wusvc.exe) executing process injection via CreateRemoteThread. The malicious dropper, often found in user-writable directories, mimics the legitimate Windows Update service (wusvc.exe) and utilizes advanced injection techniques, including PEB traversal for API resolution and APC injection, to deploy the VSHELL RAT.
Detects execution of Windows utilities used by the TrymeLocker ransomware to inhibit system recovery, including disabling boot recovery features via bcdedit, clearing backup catalogs via wbadmin, deleting volume shadow copies via vssadmin or wmic, and disabling the Windows Recovery Environment via reagentc.
Detects the creation of a registry run key entry in HKLM that points to an executable named 'browser.exe' located within a user's AppData\Local directory, specifically matching a GUID-based subfolder structure. This behavior is indicative of malicious persistence mechanisms, where an adversary attempts to execute a masqueraded binary upon system startup.
This rule detects known evasion techniques used by the Pay2Key and Grixba malware families. It identifies timing-based delays triggered by malicious 'ping.exe' commands targeting invalid IP addresses and locale-based geofencing checks performed via registry queries for custom locale settings.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
Page 689 of 1168