Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Detects remote LSASS memory dumping patterns associated with the lsassy tool, leveraging comsvcs.dll to create memory dumps of the LSASS process. The rule identifies suspicious command lines involving comsvcs.dll ordinal-based exports (ordinal #+000024), tasklist enumeration for PID discovery, and subsequent dump file creation within \Windows\Temp\. It monitors remote execution methods often observed in Bumblebee and Akira campaigns, such as WMI or DCOM/MMC-based process spawning.
Detects the Bumblebee loader technique where the Windows UAC consent UI (consent.exe) loads a malicious msimg32.dll from a non-standard, user-controlled path (such as a temporary directory created by a trojanized MSI installer) instead of the legitimate Windows system directory.
Detects symlink or junction point creation by standard users targeting sensitive system directories, a core mechanism of CVE-2026-41091.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Detects instances where the Microsoft Compiled HTML Help executable (hh.exe) spawns wscript.exe. This behavior is a common indicator of a Compiled HTML Help (CHM) file being used to execute an embedded VBScript payload, often as part of an initial access or early stage infection chain.
Detects the creation of scheduled tasks using the Windows schtasks utility where the task action points to a file located in common user-writable directories such as AppData, Temp, Users\Public, or Downloads. This behavior is frequently associated with persistence mechanisms used by malware and backdoors.
This rule detects activities associated with the MiniBrowse tool, specifically targeting unauthorized access to browser credential stores (Login Data, Cookies) and staging files for exfiltration. Additionally, it monitors for process injection events where MiniBrowse components are injected into legitimate browser processes such as Chrome or Edge.
Detects the execution of VBScript files using wscript.exe with the /B (batch) flag when the file is located within user-specific directories such as AppData, Temp, or user profiles. This pattern is commonly used by malware and loaders to execute scripts stealthily in user-writable locations.
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Page 714 of 1168