Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where a legitimate, signed executable residing in a Program Files directory loads a DLL from a location other than standard Windows system directories. This behavior is indicative of DLL side-loading or DLL hijacking, techniques commonly used by loaders such as HijackLoader (IDAT Loader) and CastleLoader to execute malicious code within the context of a trusted process.
Detects behavior indicative of the Vidar information stealer, specifically the mass access of web browser credential stores (Login Data, Cookies) followed by the execution of archive utilities (7z, rar, WinRAR) to stage stolen data for exfiltration.
Detects behavior consistent with the Vidar/Wingo loader, part of Operation Turb00, where a process probes for VM/sandbox artifacts, specifically the VMware Tools daemon path and WMI ETW restrictions registry keys, followed by a rapid process termination characteristic of sandbox evasion.
Detects the execution of ssh-add.exe from a Temp directory, which occurs as part of an attack chain involving a trojanized Franz Electron app. The process leverages DLL side-loading by loading malicious msys-crypto-3.dll, msys-2.0.dll, and msys-gcc_s-seh-1.dll, identified as components of the ResiLoader malware.
Detects a signed host process (VirtualAr.exe, NeuroManag.exe) loading a .tmp file as an executable image. This behavior is indicative of a process-hollowing variant where a malicious payload is mapped directly into memory from a cached, non-flushed temporary file, a technique observed in campaigns like Operation Turb00 involving Vidar infostealer.
This rule identifies endpoints identified as EMS or FortiClient that exhibit an unusually high number of login events (greater than 20) or a high number of unique accounts logging in (greater than 10) within a specific timeframe. This behavior may indicate unauthorized access attempts, automated password spraying, or potential lateral movement activity directed at remote access infrastructure.
This rule detects instances of specific DLLs (Qt5Core.dll or opera_elf.dll) being loaded by known suspicious executables (WizardDa42.exe or AlphVector.exe) from non-standard, potentially user-writable directories like ProgramData or Temp. The rule further filters to include instances where the module's signature is invalid, unsigned, or untrusted, which is characteristic of malicious process masquerading or side-loading.
Detects a process interacting multiple times with VMware Tools (vmtoolsd.exe) followed by multiple interactions with WMI Restrictions registry keys within a 15-minute window. This behavioral pattern is indicative of potential privilege escalation or environment discovery techniques where an adversary attempts to modify security restrictions while masquerading or interacting with legitimate virtualization management components.
Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
Page 693 of 1168