Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential Command and Control (C2) infrastructure rotation and DNS exfiltration by correlating DNS-over-HTTPS (DoH) traffic to Google Public DNS (8.8.8.8) with concurrent outbound connections to a high count (>=5) of distinct external IP addresses within a one-hour window. This behavior is consistent with the Nightmare Eclipse/VerdantBamboo post-disclosure tactical shifts to obfuscate DNS queries and rotate C2 endpoints.
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
Detects the Yuta .NET WPF dropper (SLaunch.exe) writing a PyInstaller-compiled payload (winupdate.exe) to the AppData Roaming .cache directory, followed by the immediate execution of the staged payload from that same location.
Detects the Glove Stealer (Yuta) payload, identified as winupdate.exe, performing registry queries for virtual machine artifacts such as VMware, VirtualBox, or QEMU strings. This is a common sandbox evasion technique to determine if the malware is running in an analysis environment.
Detects the use of legitimate Windows administrative tools and scripts to disable or delete system recovery features, such as Volume Shadow Copies, backup catalogs, or boot recovery options. This behavior is a common indicator of ransomware or destructive malware attempting to prevent system restoration.
This rule detects the use of common Windows utilities and PowerShell commands for process discovery, such as tasklist.exe, wmic.exe, and Get-Process. It also flags execution of command lines containing references to known antivirus, EDR, or security agent process names, which is a common indicator of an adversary attempting to identify or disable security tools.
Detects the execution of known script host binaries (mshta.exe, wscript.exe, cscript.exe) from suspicious user-writable directories (Downloads, Temp, AppData, Desktop). The detection specifically looks for these binaries when spawned by common applications like archive utilities (7-zip, WinRAR, WinZip) or shell interfaces (explorer.exe, cmd.exe, powershell.exe), which is a common pattern for the execution of downloaded or extracted malicious payloads.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects persistence mechanisms associated with Obsidian Sandstorm activity, including scheduled task creation, registry run key modification, and startup folder file drops initiated by suspicious processes or from non-standard directories like AppData/Temp.
Page 721 of 1168