Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,592 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
Detects spearphishing lure documents or office applications spawning specific executables associated with the Mustang Panda SHARDLOADER infection chain, which facilitates DLL sideloading.
This rule detects instances where cmd.exe is spawned by unusual parent processes (pcl2bmp.exe, MediumInstStart.exe, or ctxmui.dll) and executes common reconnaissance commands. This pattern often indicates post-exploitation discovery activity following the execution of suspicious or illegitimate binary files.
This rule detects potential DLL side-loading and file staging activity by monitoring for the execution of specific suspicious binaries or the loading of known malicious DLLs from non-standard or staging directories like C:\Users\Public\Documents\ or C:\ProgramData\IDM\logs\. The rule flags activity associated with loaders like SHARDLOADER, ZOHOMURK, and MINIRECON.
Detects the use of 'netsh trace' to capture network traffic with specific suspicious flags, such as circular file mode, reporting disabled, or interaction with administrative shares. This behavior is often associated with network reconnaissance or the collection of sensitive data by adversaries.
This rule monitors process creation events for 'git' or 'npm' command-line activities that are highly indicative of potential software supply chain attacks. It triggers when known malicious package names or suspicious patterns are detected within command-line arguments, or when a workflow involves a git clone followed by subsequent npm installation, which is a common vector for deploying malicious dependencies.
Detects malicious use of PowerShell cmdlets to modify Group Policy Objects (GPOs) for ransomware distribution. The rule monitors for execution of GPO management cmdlets in conjunction with specific ransomware indicators, such as disabling Windows Defender real-time monitoring, modifying GPO machine extension names, or targeting SYSVOL/NETLOGON network shares.
Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.
Detects a git clone operation performed in a potentially untrusted or sensitive directory (e.g., Desktop, Downloads, Temp) followed immediately by code execution using common interpreters (node, python, powershell). This behavior is consistent with the Lazarus Group 'Contagious Interview' campaign, where attackers lure developers into cloning and executing malicious code repositories via social engineering.
Detects instances where Python or Node.js processes access common cloud provider credential files (e.g., AWS, GCP, Azure). This behavior is often associated with infostealer campaigns, such as the 'Contagious Interview' campaign, where adversaries attempt to harvest stored cloud credentials for further compromise.
Page 758 of 1168