Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of known Remcos Remote Access Trojan (RAT) watchdog processes (e.g., iexplore.exe, svchost.exe, fsutil.exe) when spawned by suspicious parent processes or running from non-standard file paths such as Temp, AppData, or ProgramData, which are common indicators of malicious activity.
Detects suspicious discovery commands often used by adversaries for environmental reconnaissance, including querying security product status via WMIC, enumerating installed software, or executing tasklist.exe from non-standard system paths.
Detects reconnaissance activities performed by system binaries (wmic.exe, reg.exe, tasklist.exe) that are commonly used to enumerate security software, registry keys, and system configuration. Additionally, it alerts on any of these tools being spawned by processes originating from the ProgramData\Remcos directory, which is a known indicator of the Remcos Remote Access Trojan (RAT).
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.
This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects node.exe or npm processes accessing directory paths associated with popular browser cryptocurrency wallet extensions, a behavior indicative of the Miasma infostealer used in supply chain attacks.
Detects Node.js or npm processes accessing sensitive developer configuration and credential files. This rule is designed to identify malicious supply chain activity, specifically matching patterns where npm postinstall scripts or malicious node modules attempt to exfiltrate files such as .gitconfig, SSH keys, cloud credentials, and tokens from a developer workstation.
Detects Remcos RAT utilizing a COM-based UAC bypass technique. The malware leverages the CMSTPLUA CLSID ({3E5FC7F9-9A51-4367-9063-A120244FBEC7}) and the ICMLuaUtil interface to spawn an elevated process without a UAC prompt. This rule monitors for DllHost.exe acting as a COM surrogate and spawning suspicious child processes (cmd.exe, powershell.exe) or being initiated with the specific CMSTPLUA CLSID, as well as fodhelper/computerdefaults UAC bypass variants.
Page 741 of 1168