Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of Windows Scheduled Tasks using either 'schtasks.exe' or 'powershell.exe' (via 'Register-ScheduledTask') with specific persistence flags, such as 'ONLOGON', 'ONSTART', 'SYSTEM' privileges, or 'HighestAvailable' execution levels. This behavior is commonly used by adversaries for persistence or privilege escalation.
Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.
Detects network activity associated with the SPECTRALVIPER malware family attributed to OceanLotus (APT32). The rule monitors for connections to known malicious C2 infrastructure (IPs and domains) and behavioral anomalies where the 'OneDrive.Sync.Services.exe' process makes outbound network connections to non-private addresses, which is indicative of process injection.
Detects a cluster of common discovery commands (e.g., ipconfig, whoami, net group) being executed within a short 60-second window, suggesting automated enumeration behavior by an adversary.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
This rule detects instances where the SQL Server process (sqlservr.exe) spawns common command-line interpreters or administrative utilities that are frequently abused by attackers for post-exploitation activities, such as command execution, enumeration, or evasion. This behavior often indicates an attempt to leverage SQL Server's capabilities to execute operating system commands, such as via the xp_cmdshell procedure.
Detects Microsoft SQL Server (sqlservr.exe or mssql.exe) spawning common administrative or potentially malicious utilities (e.g., cmd.exe, powershell.exe, curl.exe, etc.). This behavior is often indicative of unauthorized code execution or lateral movement originating from the database engine, which should not typically initiate these processes.
Detects the use of Windows Package Manager utilities (winget.exe, WindowsPackageManagerServer.exe) or ConfigurationRemotingServer.exe to execute administrative commands related to local user and group management, such as adding users or modifying group memberships. This behavior is highly irregular for these binaries and suggests potential abuse for persistence or privilege escalation.
This rule detects internal strings associated with the SPECTRALVIPER framework, specifically identifying commands related to the orchestration of lateral movement via named pipes. These indicators suggest active post-exploitation movement using custom pivot links and pipe communication.
This rule detects lateral movement activity and implant deployment patterns associated with the threat group OceanLotus (APT32). It monitors for the creation of specific suspicious files and paths often used by SPECTRALVIPER/WINDSHIELD malware, identifies file transfers over SMB orchestrated by system processes, tracks the execution of remote administration tools like PsExec, and identifies internal pivot activity via named pipes.
Page 729 of 1168