Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects periodic image file creation (e.g., .bmp, .png, .jpg) in user-writable temporary or application data directories by non-UI processes. This pattern is consistent with the behavior of remote access trojans (RATs) such as Atlas RAT and Gh0stRAT, which capture screenshots and stage them for exfiltration.
Detects unauthorized webcam usage by monitoring for the loading of avicap32.dll by non-standard processes. This behavior is indicative of the Atlas RAT, which leverages the avicap32 library to perform illicit video surveillance on compromised hosts.
Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects network activity initiated by qemu-system-x86_64.exe to internal subnets using common lateral movement ports (21, 88, 389, 445, 636) or the execution of known tools netbird.exe or cookie_exporter.exe. This rule flags potential virtualization-based lateral movement or unauthorized tool usage.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) that include command-line arguments referencing virtualization artifacts (qemu, .qcow2, .vmdk, TPMProfiler) or specific database/dll files (vault.db, bisrv.dll). This pattern is often indicative of persistence mechanisms used by malware or threat actors to manage virtualized environments, exfiltrate data, or deploy components.
Page 723 of 1168