Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for the loading of 'avicap32.dll' by processes that are not typically associated with video or audio conferencing and recording. 'avicap32.dll' is a legacy Windows library used for capturing video, often abused by malware to secretly access webcams for surveillance purposes. By filtering out known legitimate applications (e.g., Zoom, Teams, OBS, Skype), this rule flags potential unauthorized access to video capture capabilities.
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
Detects non-browser processes attempting to read, create, or modify browser-specific credential storage files (e.g., 'Login Data', 'logins.json', 'signons.sqlite') associated with Chromium-based browsers or Firefox. This activity is a common indicator of credential theft by malware such as Atlas RAT or ValleyRAT.
This rule detects post-click execution chains typical of RomulusLoader delivery, specifically identifying when browser or archive applications launch unsigned processes from user-writable directories (e.g., Downloads, Temp), or when a suspicious vulkan-1.dll module is sideloaded from these same directories.
Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.
Detects instances where a digitally signed executable loads a DLL file from a user-writable directory (e.g., AppData, Downloads, Temp). This is a common technique used by threat actors, such as in TA4922 campaigns, to execute malicious payloads (e.g., Atlas RAT or ValleyRAT) by sideloading them into a trusted process, effectively bypassing application allow-listing and environment security controls.
This rule monitors Windows Sysmon Event ID 10 (ProcessAccess) for suspicious activity where the CallTrace indicates the use of direct syscalls (bypassing standard Win32 DLL chain) or anomalous execution paths while targeting high-value processes such as security agents, system services, and critical infrastructure (e.g., lsass.exe, svchost.exe).
This rule monitors network traffic for activity related to the Tox decentralized protocol. It identifies specific domains (tox.chat) or known hex-encoded identifiers associated with Payouts King ransomware leak sites and ransom notes embedded in network requests or payloads.
Detects processes attempting to load multimedia DLLs or access video capture devices that are not associated with authorized communication, media, or browser applications. This logic identifies potentially malicious attempts to capture video feeds from local cameras.
Detects network, proxy, or DNS activity associated with .onion pseudo-top-level domains, which are typically used for Tor anonymity services. The rule distinguishes between generic access to the Tor network and specific high-confidence interactions with known malicious onion addresses associated with payout or extortion sites.
Page 722 of 1168