Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the deletion of a .jse file from the user's Downloads directory by Windows Script Host (wscript.exe or cscript.exe). This behavior is consistent with the NUKESPED loader's anti-forensic cleanup routine, where the initial dropper deletes itself after staging subsequent payloads in secondary locations like ProgramData.
Detects the execution of the NUKESPED backdoor component 'zlrenu8.exe', which is associated with Kimsuky threat actor activity. This component is known to function as a keystroke logger using SetWindowsHookEx to capture user input.
Detects the NUKESPED backdoor (zlrenu8.exe) performing post-compromise system information discovery. The rule monitors for registry key enumeration within HKLM/HKCU SOFTWARE hives and the execution of the systeminfo.exe utility.
Detects instances of the legitimate Windows system utility fltMC.exe running from a temporary directory (Temp or tmp) that initiates network connections. This behavior is indicative of the JFMBackdoor malware masquerading as a system tool to perform network enumeration by leveraging APIs like GetExtendedTcpTable or GetExtendedUdpTable.
This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects the use of the legitimate Windows utility fltMC.exe to perform timestomping (modifying file timestamps) on specific malicious or deployment-related files (such as FLTLIB.dll, scr.mui, and flt.bin) located in temporary directories. This activity is associated with the JFMBackdoor used by the Red Lamassu threat actor to evade timeline-based forensic analysis.
Detects outbound TCP traffic destined for known Tor relay ports (9001 and 9030) originating from internal RFC 1918 address space. This behavior is indicative of compromised edge devices or IoT hardware attempting to establish command and control (C2) communication via the Tor network, a tactic commonly used by threat actors to obfuscate their infrastructure and C2 traffic.
Detects DLL sideloading attempts associated with the Red Lamassu threat activity. The rule monitors for common Windows system binaries (odbcconf.exe, regsvr32.exe, rundll32.exe, and svchost.exe) loading DLL files from user-writable directories such as Temp, Downloads, AppData, and ProgramData, while filtering out legitimate loads from standard system paths.
This rule detects potential Server-Side Request Forgery (SSRF) probing attempts against web applications where unauthenticated requests contain a URL parameter used to request external or internal resources. It flags high-volume probing activity and correlates the source IP with concurrent anomalous Azure Active Directory (Azure AD) sign-in events from the same source, such as failed logins or high-risk sign-in attempts.
Page 733 of 1168