Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects svchost.exe or 'Mixed Reality.exe' spawning common system and security enumeration tools (such as wmic.exe, systeminfo.exe, or tasklist.exe) with command-line arguments indicative of the DcRAT 'SendInfo()' routine. This pattern is characteristic of malware performing reconnaissance of installed security software and system identification.
This rule monitors for node.exe processes running from the AppData directory initiating multiple network connections to non-private (external) IP addresses over common web ports (80, 443, 8080, 8443). Running Node.js from user-writable temporary directories can be an indicator of malicious activity or the execution of unauthorized web applications attempting command and control communication.
Detects sandbox evasion behavior linked to the Operation DragonReturn DcRAT loader. The malware uses the GetTickCount64 API in a tight loop with Sleep(1) calls to identify and detect sandbox environments that accelerate system time. The rule monitors for the suspicious execution of specific executables and subsequent process injection into svchost.exe.
Detects Millenium RAT establishing persistence by creating a Registry Run key (MsEdgeUpdate) that executes a binary named svchost.exe from an obfuscated AppData subdirectory, or identifies general persistence attempts by creating Registry Run keys pointing to executables within user-writable AppData or Temp directories.
Detects the execution of 'JuicyPotato', a known tool used for local privilege escalation on Windows systems by abusing the BITS service or DCOM to achieve arbitrary process execution as SYSTEM.
Detects the DcRAT malware implant executing svchost.exe as a child process of 'Mixed Reality.exe', a behavior used during the malware's SendInfo phase to enumerate security products and prepare for AMSI patching.
Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.
Detects execution of PowerShell processes spawned by script hosts (wscript.exe, mshta.exe) with common bypass/encoded flags. The rule identifies suspicious command-line patterns involving known malicious infrastructure domains or specific suspected payload filenames, indicative of the Millenium RAT dropper activity.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects the creation or modification of Windows Registry Run keys that point to files within user-writable directories (AppData or Temp). This behavior is correlated with preceding execution of script interpreters (PowerShell, WScript, CScript, MSHTA, Node, or CMD) on the same endpoint, which is a common pattern for dropper or RAT installation stages.
Page 697 of 1168