Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances of a Node.js process accessing sensitive browser credential and cookie storage files, which is a common behavior associated with credential theft malware or malicious scripts.
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
This rule detects potential unauthorized access to web browser data files (such as logins, cookies, and history databases) or specific registry modifications indicative of browser hijacking or credential theft. It monitors for processes other than known web browsers accessing sensitive browser configuration files or creating registry keys in HKCU that might be used for persistence or browser configuration manipulation.
Detects multiple processes accessing sensitive browser data files like 'Local State' and 'Login Data', commonly associated with credential theft activities from web browsers.
Detects the execution of the 'fortigatesniffer' binary, which is often associated with packet capture and network reconnaissance activities on a host.
Detects the execution of ServiceModelReg.exe followed by suspicious network or file system activity. ServiceModelReg.exe is a legitimate Windows utility that may be abused by adversaries for process hollowing or masquerading to evade defenses.
Detects potential UAC bypass attempts using common Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) that execute suspicious child processes, or by detecting the creation of related registry keys (ms-settings) used for these bypass techniques.
Detects the execution of 'ResiLoader.exe' in an environment where it does not load standard .NET runtime dependency modules (e.g., clr.dll, coreclr.dll). This behavior is characteristic of loaders attempting to obfuscate their .NET nature or executing in a manner that bypasses standard managed code monitoring.
Detects the AlphVector executable loading specific DLL modules (opera_elf.dll or WebView2Loader.dll) from a suspicious directory (C:\ProgramData\service\), which is a characteristic behavior of DLL side-loading to bypass security controls.
Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.
Page 692 of 1168