Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to modify the WDigest UseLogonCredential registry value, which can be used to force Windows to store plaintext credentials in LSASS memory. Adversaries use this technique to facilitate credential dumping.
Detects the execution of command-line interfaces (cmd.exe, powershell.exe, wscript.exe, mshta.exe) when spawned by common browser processes or Windows Explorer. This is a common pattern for drive-by downloads or malicious scripts executed via the browser, characterized by command lines containing download indicators (e.g., Invoke-Expression, curl, certutil, encoded commands).
Detects modifications to the 'UseLogonCredential' registry value under the WDigest security provider. Enabling this setting allows Windows to store plaintext credentials in memory (LSASS), which facilitates credential theft and credential dumping attacks.
Detects the use of WinRAR (rar.exe or WinRAR.exe) to archive files, specifically flagging operations that involve recursion, password protection (-hp), or targeting network shares. This behavior is commonly used by adversaries for data staging prior to exfiltration.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.
Detects the use of the appcmd.exe utility to disable IIS HTTP logging by setting the 'dontLog' configuration attribute to 'True'. This behavior is commonly used by attackers to hide malicious activity, such as webshell POST requests, from being captured in IIS logs.
Detects Mimikatz-based credential dumping against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies this activity by monitoring for renamed or known Mimikatz binary names, execution of specific credential-harvesting command-line arguments (such as sekurlsa::logonpasswords or privilege::debug), output redirection to credential-related files, or the loading of the Mimikatz kernel driver (mimidrv.sys).
Detects reconnaissance activities where an adversary attempts to identify installed security software (AV, EDR, logging tools) on a Windows host. The rule identifies the execution of common discovery commands including PowerShell Get-MpComputerStatus, wmic, sc query, tasklist, and reg query targeting specific security process names and registry paths.
Detects the creation of a new .vhdx virtual disk file by hypervisor management processes. This behavior is used by threat actors, specifically Akira ransomware, to instantiate new virtual machines that lack organizational security tooling to evade endpoint detection before proceeding with malicious activities.
Page 695 of 1168