Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects the creation or modification of Windows Registry Run keys that point to files within user-writable directories (AppData or Temp). This behavior is correlated with preceding execution of script interpreters (PowerShell, WScript, CScript, MSHTA, Node, or CMD) on the same endpoint, which is a common pattern for dropper or RAT installation stages.
Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.
Detects suspicious API call sequences indicative of process injection into the 'svchost.exe' system process. The rule monitors for a combination of memory manipulation and thread execution APIs, such as 'ZwWriteVirtualMemory', 'NtDuplicateObject', 'VirtualAllocEx', and 'CreateRemoteThread', when initiated by processes other than legitimate Windows system processes. This is a common indicator of unauthorized code execution or lateral movement.
Detects the execution of 'whoami' via 'cmd.exe' when the parent process is suspicious, such as running from an AppData folder, originating from a suspicious directory named 'Liu5GgJiKiKqe2Qs', or when 'svchost.exe' is executed outside of the standard 'System32' directory. This pattern is commonly used for UAC elevation checks or reconnaissance by malicious software.
Detects unauthorized processes attempting to access sensitive browser credential files (Login Data and Cookies) for Chrome, Edge, and Firefox. The rule applies risk scoring based on whether the accessing process is located in suspicious directories (e.g., Temp, Downloads) or if specific indicators associated with the Millenium RAT are present.
Detects the presence of a specific global event object 'Global\ShitSetupOn26126k' used as a mutex or single-instance check by the DragonReturn malware dropper.
This rule detects potential phishing attempts by identifying emails with subject lines and attachment names related to Income Tax or official tax filings. The detection logic correlates indicators such as specific tax-related subject phrases, common tax utility attachments, suspicious URLs (govtop.one), and sender spoofing (impersonating 'Government of India' without a valid .gov.in domain).
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
This rule detects screen capture activities associated with DcRAT, Millenium RAT, and Operation DragonReturn. It identifies the creation of specific staging files (e.g., debug.txt, background.jpg) at sensitive paths and monitors for non-standard or masquerading processes (such as svchost.exe running outside System32) that create image files in user-writable or temporary directories. The rule uses tiered logic, assigning a higher risk score to known IOC patterns and periodic capture behavior.
Page 698 of 1168