Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,592 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.
Detects attempts by unsigned processes to read or modify sensitive web browser credential files (Login Data or logins.json) typically used by Google Chrome, Microsoft Edge, and Mozilla Firefox. This behavior is indicative of credential dumping or information stealing activities by unauthorized or malicious software.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Detects the execution of node.exe from unusual parent processes and suspicious locations like AppData, Temp, or user-writable profile folders. This behavior is indicative of the TONResolver RAT, where node.exe is utilized to execute malicious JavaScript payloads disguised as legitimate processes.
This rule detects rapid scanning of local network subnets on SMB (port 445) and RDP (port 3389) by a single process on a device. It identifies instances where a process initiates connections to more than 20 unique local IP addresses within a one-minute window, which could indicate an attempt by ransomware, such as Nightspire, to identify adjacent victims for propagation prior to local encryption.
Detects the CastleLoader Python process rapidly scraping Chromium SQLite databases (Login Data, Cookies) to steal stored credentials and session cookies. The rule identifies Python processes accessing multiple browser credential/session databases within a one-minute window.
This rule monitors for processes that repeatedly call GetTickCount64 while also invoking sleep functions, a common technique used by malware to detect virtualized environments or sandboxes by measuring time intervals and stalling execution to bypass short-duration automated analysis. The rule prioritizes alerts originating from non-standard system paths or processes.
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
Detects suspicious PowerShell command-line activity commonly associated with malicious scripts, including execution bypass (e.g., -ep bypass), the use of .NET BigInteger for potential obfuscation, and downloading files via Invoke-WebRequest to the temp directory. The rule further increases fidelity by identifying if the parent process is a common execution vector such as explorer.exe, wscript.exe, or mshta.exe.
Page 749 of 1168