Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,587 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of files associated with the SPECTRALVIPER malware, used by OceanLotus for DLL sideloading. This rule specifically monitors for known launcher executables (e.g., Genuine.exe, Updater.exe) and associated configuration/payload files (e.g., GlobalSettings.conf, appcompat.log) being dropped into directories commonly used for persistence or lateral movement, such as Autodesk and Windows appcompat folders.
Detects cross-process memory operations and remote thread creation associated with the SPECTRALVIPER sideloading chain. It specifically flags injections originating from IntelAudioService.exe into OneDrive or svchost processes, the loading of the DtlCrashCatch.dll module, and general suspicious remote thread or memory write operations against these targets, excluding known system processes and security software.
Detects the SQL Server process (sqlservr.exe) spawning suspicious child processes often associated with reconnaissance or command execution, such as command shell, PowerShell, or network diagnostic utilities. This is a common technique used by adversaries to execute commands or perform post-exploitation activities via database services.
Detects the Windows Package Manager (winget.exe) spawning the ConfigurationRemotingServer.exe process. This behavior, observed when using the 'winget configure' command, may indicate the execution of embedded PowerShell DSC scripts that can be used to maliciously configure a machine.
Detects instances where the Microsoft SQL Server process (sqlservr.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative tools. This behavior is often indicative of remote code execution exploitation or post-exploitation activities following initial access on a database server.
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
Detects instances where DllHost.exe creates executable or script files within sensitive Windows directories (e.g., Public, Temp, ProgramData). This behavior is often indicative of WSL2 filesystem proxying, where a Linux process initiates a file write to the Windows filesystem via /mnt/c/, causing the DllHost.exe process to proxy the write operation and obscuring the original Linux process origin.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser inconsistencies. Attackers use a 'github.com@' prefix within a URL parameter to trick backend fetchers into connecting to unintended, potentially internal, hosts like 'metadata.google.internal', bypassing validation logic that incorrectly parses the URL authority.
Detects GreenBlood ransomware attempting to establish persistence by creating a new Windows service. This rule identifies suspicious 'sc.exe' commands that include 'green' or 'blood' in the service name, or 'sc.exe' commands creating services from common temporary/application data paths. It also looks for direct registry modifications to the Services key with 'green' or 'blood' in the key name.
Detects instances where the Windows Subsystem for Linux (wsl.exe) process is used to launch standard Windows command-line interpreters (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used as a technique to facilitate cross-environment execution or to evade certain security controls by running Windows binaries from within the WSL context.
Page 730 of 1168