Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Visual Studio Code or Cursor IDE spawning interpreter processes like node.exe or python.exe. This behavior is indicative of a malicious .vscode/tasks.json configuration leveraging the 'runOn': 'folderOpen' feature to achieve automatic execution of code upon opening a workspace, a technique associated with the Lazarus Group 'Contagious Interview' campaign.
Detects DLL sideloading activity attributed to the Mustang Panda group, where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver are used to load potentially malicious DLLs (e.g., SHARDLOADER, MINIRECON, ZOHOMURK) from non-standard, user-writable directories including ProgramData, Public folders, and Temp directories.
Detects the use of 'netsh trace' to capture network traffic, often associated with reconnaissance activity by threat actors like The Gentlemen RaaS. The rule monitors for command patterns involving trace start/stop, interface show, and specific configuration flags like 'capture=yes', 'report=no', 'filemode=circular', or output to 'ADMIN$' shares.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects the use of the 'netsh trace' command to initiate network packet capture, executed via cmd.exe or powershell.exe. This activity is a known technique used by The Gentlemen RaaS group to perform credential harvesting from unencrypted internal network traffic by saving packet capture files to administrative shares.
Detects potential DLL sideloading activities where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver components load dynamic link libraries (DLLs) from non-standard or user-writable directory paths (e.g., Temp, AppData, Downloads). This behavior is characteristic of delivery chains associated with threat actor Mustang Panda, specifically utilizing loaders like SHARDLOADER or MINIRECON.
Detects unauthorized file access to common developer credential storage locations on Linux workstations, including SSH keys, cloud provider configuration files, and browser session artifacts. This behavior is associated with the InvisibleFerret payload used in the Lazarus Contagious Interview campaign to exfiltrate identity and access tokens from developer machines.
Detects malicious child process creation behavior associated with the BeaverTail JavaScript infostealer during the installation of compromised npm packages. The rule monitors for 'node.exe' spawning suspicious shell or interpreter processes (e.g., python, curl, powershell) in conjunction with strings indicative of known malicious delivery mechanisms (e.g., specific filenames like 'lserver.js', 'jsonwebauth', or external hosting domains).
Detects Python or Node.js processes accessing files associated with cryptocurrency wallets and browser extension storage. This behavior is indicative of credential or wallet theft, as observed in campaigns such as 'Contagious Interview' which involved threats like BeaverTail and InvisibleFerret.
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
Page 704 of 1168