Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the SNOWLIGHT dropper (disguised as the Windows Update Service 'wusvc.exe') attempting to establish an outbound network connection to a known malicious C2 infrastructure (38.60.253.35) on port 8084. The rule also accounts for the use of non-standard port communication and monitors for suspicious process masquerading outside of protected system directories.
Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.
Detects execution of PowerShell commands that use the ExecutionPolicy Bypass flag while concurrently attempting to suspend BitLocker protection. This behavior is highly characteristic of ransomware activity, specifically associated with the ShrinkLocker malware, where the adversary disables disk encryption protection to facilitate malicious operations or subsequent encryption.
This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.
Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.
Detects the execution of VILE ransomware by correlating the launch of the binary with the creation of specific artifacts used for system information discovery, specifically timezone-based geofencing and anti-analysis configurations.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
Detects evidence of VILE ransomware behavior involving token and privilege manipulation, including the use of Windows API functions such as AdjustTokenPrivileges, OpenProcessToken, and DuplicateTokenEx, as well as potential EDR bypass indicators via NT syscalls like NtCreateWaitCompletionPacket.
Detects the use of built-in Windows utilities 'wbadmin.exe' and 'bcdedit.exe' with arguments that inhibit system recovery features. Specifically, it monitors for the deletion of the Windows Backup Catalog using 'wbadmin.exe' and the disabling of system recovery/boot failure handling via 'bcdedit.exe'. These actions are commonly performed by ransomware or adversaries to prevent system recovery.
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Page 709 of 1168