Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation of new user accounts via the Windows 'net user' command or Windows Security Event 4720 where the account name or command line arguments contain the string 'rage_master_'. This pattern suggests the potential creation of an unauthorized or backdoor account, possibly related to a specific naming convention used by an actor or a naming collision with malicious activity.
Detects potential phishing activity involving a two-hop open-redirect chain. The rule monitors for an initial navigation to known SaaS platforms (HolaBrief or LoopedIn), followed within one minute by an outbound request to an external destination where the SaaS domain is present in the HTTP referrer header, indicating a redirect-based phishing mechanism.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
Detects the Windows Update service (wusvc.exe) loading the advapi32.dll library. While advapi32.dll is a standard Windows component, unauthorized or unexpected library loading by system processes can be an indicator of DLL side-loading, process injection, or other hijacking techniques used to execute malicious code within a trusted context.
Detects the creation of scheduled tasks using schtasks.exe initiated from potentially suspicious parent directories (C:\Users\Public\ or C:\Windows\Temp\) or parent processes containing 'win_guard_'. This behavior is often associated with malware attempting persistence.
This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.
Detects potential process injection attempts involving the Windows Update service (wusvc.exe). The rule monitors for remote thread creation or APC injection activities combined with memory operations (VirtualAlloc or VirtualProtect) that set memory regions to PAGE_EXECUTE_READWRITE, which is a common pattern for running shellcode in a hijacked process context.
This rule detects outbound network connections to the specific IP address 38.60.253.35 on port 8084. Such traffic is highly suspicious and indicative of potential communication with a Command and Control (C2) server.
Detects instances of the wusvc.exe process being executed and subsequently performing file write or module load operations. This pattern is often used by adversaries to mask malicious activity by masquerading as the legitimate Windows Update service.
Detects the creation or modification of Windows Active Setup registry keys ('StubPath') used by TrymeLocker to achieve persistence. The rule monitors for keys pointing to executables in suspicious locations such as Windows Temp, Users Public, ProgramData, or AppData, and identifies specific threat-related patterns like 'win_guard_', 'RageCore_', and '{RAGE-MASTER}'.
Page 708 of 1168