Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects endpoint file creation or modification events involving PDF files with suspicious, lure-like filenames (e.g., 'Settlement Agreement') being written by email clients or web browsers. This rule acts as a proxy for identifying potential spearphishing attachment execution on the endpoint.
Detects LCRYX ransomware activity characterized by the execution of VBScript files via wscript/cscript, followed by attempts to disable security products (Windows Defender or third-party AVs) using command-line utilities, and establishing persistence via Registry Run keys within a 10-minute window on the same host.
Detects instances where the Windows Installer (msiexec.exe) initiates a command prompt (cmd.exe) session from an AppData directory. This behavior is indicative of potential malicious activity, as installers are sometimes abused to proxy execution of payloads residing in user-writable temporary directories.
Detects execution of cmd.exe or other binaries spawned by msiexec.exe involving the LegionLoader staging directory 'AppData\Roaming\Traiolx Custom Utils' and the 'xupdate.bat' script, which is characteristic of LegionLoader's post-installation activity.
Detects malicious process, file, and registry activities associated with Hannibal Stealer staging directories and characteristic command-line execution patterns, specifically targeting indicators like CefSharp.BrowsersSubprocess and specific DLL function delegates used in staging.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects a sequence of actions often performed by the LCRYX ransomware, characterized by the suppression of Windows boot recovery settings via BCDEdit followed by the deletion of volume shadow copies (using vssadmin or wmic) or backup catalogs (using wbadmin), all executed from the same process within a 10-minute window.
Detects spearphishing emails delivered through Google Workspace infrastructure that fail DMARC strict alignment check. Specifically, this monitors instances where the DKIM signing domain is a gappssmtp.com subdomain that fails alignment with the envelope sender domain, while concurrently carrying a PDF attachment, consistent with known phishing campaign patterns.
Detects malicious Control Panel (.cpl) file execution via legitimate Windows binaries like dllhost.exe or rundll32.exe. Attackers often abuse these binaries to bypass security controls. The rule specifically alerts on instances where these processes are launched from non-standard parent processes or from high-risk directories such as AppData or Temp.
This rule detects potential email spoofing or relay abuse by identifying emails that claim to be from the 'gasparinutrition.com' domain but fail DMARC authentication, despite showing a DKIM pass status specifically associated with 'gappssmtp.com' subdomains. This behavior is indicative of an adversary attempting to bypass email authentication mechanisms by leveraging legitimate third-party mail relay infrastructure to send spoofed messages.
Page 751 of 1168