Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the rapid creation of a new user account followed immediately by that user being added to a high-privilege group (specifically those containing 'administrators' or 'remote desktop users') within a 60-second window. It monitors Windows Security event logs for Event IDs 4720 (User Account Created) and 4732 (Member added to security-enabled local group).
This rule detects potential User Account Control (UAC) bypass attempts involving eventvwr.exe. It monitors for three suspicious patterns: eventvwr.exe spawning a child process that is not mmc.exe, modification of the HKCU\Software\Classes\mscfile\shell\open\command registry key used for hijacking file associations, and eventvwr.exe being launched from a non-standard system directory.
Detects the execution of the Chisel proxy/tunneling tool and associated network activity. The rule monitors for processes named 'chisel' with command-line arguments indicative of server or client mode, as well as network connections initiated by such processes, specifically flagging non-standard ports or known tunneling indicators on standard ports.
Detects the execution of QEMU binary variants (qemu-system-x86_64.exe, qemu-system-i386.exe, or qemu.exe) when invoked with arguments indicative of guest networking or disk usage (e.g., -netdev, -drive). The rule further filters by identifying suspicious execution paths (e.g., Temp, AppData) or lack of legitimate hypervisor parent processes to identify potentially unauthorized virtualization or sandbox evasion activity.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
Detects network communication with the Telegram API endpoints (api.telegram.org) originating from processes other than common web browsers. The rule specifically monitors DNS queries, network connections via Sysmon, and proxy/firewall logs for requests involving common Telegram bot API methods (getUpdates, sendMessage, sendPhoto, setWebhook). It also flags execution patterns associated with specific tools (e.g., PyInstaller, bqt.exe, start.exe) that may indicate automated C2 activity.
This rule detects processes that perform a DNS query or network connection to common public IP geolocation services (e.g., ipify, icanhazip) followed by an outbound network connection to an external destination within a short time frame. It excludes common browser processes and standard system utilities, aiming to identify potentially malicious programs, custom scripts, or living-off-the-land binaries performing reconnaissance of the host's public network identity followed by external connectivity.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects User Account Control (UAC) bypass attempts where eventvwr.exe is abused via registry modification of HKCU\Software\Classes\mscfile\shell\open\command. The rule identifies suspicious child processes spawned by eventvwr.exe (such as mmc.exe, BQT.exe, or start.exe) that deviate from standard behavior, as observed in BQTLock ransomware activity.
Page 725 of 1168