Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects indicators associated with the deployment and execution of NetSupport RAT, including the launch of 'client32.exe', loading of the 'pcicl32.dll' module, outbound network connections, and the creation of the 'client.ini' configuration file. It also flags execution chains where 'client32.exe' is spawned by common browser or living-off-the-land processes.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.
Detects the use of WinRAR (rar.exe/winrar.exe) to create archives with password protection or recursive flags in common staging directories (Temp, AppData, ProgramData, Users\Public, Share). This behavior is often associated with the staging and obfuscation of collected data prior to exfiltration.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects automated scripts or command-line utilities initiating connections to Microsoft authentication endpoints using OAuth device code authorization parameters. This behavior is indicative of PhaaS (Phishing-as-a-Service) tools, such as EvilTokens, attempting to perform device code OAuth flows on behalf of an attacker to gain unauthorized access.
Detects reconnaissance activities performed on compromised web servers, including the enumeration of installed security software, installed applications via WMI or registry queries, and service/process listing. These actions are often observed as a precursor to defense impairment or further exploitation originating from web server processes like w3wp.exe.
Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.
Detects attempts to uninstall, disable, or remove ModSecurity Web Application Firewall (WAF) modules on IIS or Apache servers. This behavior often indicates an adversary attempting to impair security defenses by disabling WAF protection to facilitate further malicious activity, such as web shell deployment or exploitation.
Detects anomalous child process execution from common web browsers often associated with Browser-in-the-Browser (BitB) attacks. The rule correlates browser-spawned processes like PowerShell, cmd, or mshta with concurrent, suspicious network activity targeting login or account-related domains outside of expected conferencing platforms.
Page 743 of 1168