Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized processes reading or opening files located within the data directories of Discord or Telegram Desktop. These directories often store sensitive user data, including session tokens and local databases, which are common targets for info-stealing malware.
This rule detects the creation of files with specific suspicious names or within a specific suspicious directory path under the user's AppData Roaming folder, which is commonly used for persistence by malware or unauthorized tools.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects non-browser processes (e.g., non-standard executables) attempting to read sensitive browser data files, specifically Login Data, Cookies, or Firefox profile data. This behavior is highly characteristic of credential-stealing malware or unauthorized data exfiltration tools accessing browser-stored secrets.
Detects execution of 'tasklist.exe' when spawned by suspicious or unexpected parent processes, specifically flagging instances where the parent process resides in an AppData directory or originates from specific executables often leveraged by malicious actors. This behavior is indicative of system enumeration and discovery activity.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.
Detects the execution of DcRAT in Operation DragonReturn, which uses a specific hardcoded named mutex 'Global\ShitSetupOn26126k' to ensure only a single instance of the malware runs on the infected host. This acts as an execution guardrail to prevent multiple processes from running simultaneously.
Detects unauthorized non-browser processes attempting to access sensitive credential and session cookie files associated with major web browsers such as Chrome, Edge, and Firefox. This behavior is indicative of credential harvesting techniques often utilized by infostealer malware, including variants of the Millenium RAT, to extract stored passwords and session tokens.
Page 748 of 1168