Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
This rule monitors for suspicious activity associated with npm or Node.js processes. This includes potential credential misuse during npm publish or login, unauthorized build-time execution via node-gyp, and the use of unconventional preinstall/postinstall hooks that spawn external binaries or scripts, which are often indicative of software supply chain attacks.
Detects the modification of the WDigest 'UseLogonCredential' registry key. Enabling this key forces the WDigest security provider to store plaintext credentials in memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz.
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
Detects suspicious activities related to the execution of qemu-system-x86_64, including scheduled task creation referencing 'TPMProfiler', execution under the SYSTEM account, and outbound network communication to known malicious IP addresses on specific ports (22, 32567, 22022).
Detects Payouts King ransomware activity by identifying file rename events to the .ZWIAAW extension or the creation of the 'readme_locker.txt' ransom note on any disk path. The rule specifically accounts for file operations that might utilize techniques like SetFileInformationByHandle for evasion.
Detects Payouts King ransomware operator TTPs involving Microsoft Teams social engineering followed by Windows Quick Assist (msra.exe) abuse. The rule monitors for three primary indicators: Teams spawning Quick Assist, Quick Assist being launched with remote session-initiation flags, and Quick Assist spawning suspicious child processes (cmd, powershell, etc.) or network utilities (curl, certutil, bitsadmin) characteristic of post-exploitation payload delivery.
Detects adversary activity associated with Payouts King and Black Basta affiliates utilizing QEMU for malicious activity. The rule monitors for the creation of virtual machine disk image files in non-standard directories, the execution of QEMU using disk images with misleading file extensions such as .db or .dll, and outbound SSH connections originating from the QEMU process to tunnel traffic through a guest VM.
Detects DCSync attacks abusing the directory replication (DRSUAPI) interface by auditing Windows Security Event 4662. The rule monitors for access to directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domainDNS object, specifically excluding machine accounts and built-in service accounts to reduce noise. This behavior is indicative of unauthorized credential harvesting from Active Directory.
Detects the creation of scheduled tasks by decompression utilities or Office applications. This behavior is indicative of a dropper technique where malicious artifacts extracted from archives or spawned by Office documents establish persistence. The rule specifically monitors schtasks.exe command lines that target user-writable directories or involve rundll32-based execution, commonly used by the Obsidian Sandstorm/SilverGorilla threat actor activity.
Page 724 of 1168