Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) scripts that contain patterns indicating evasion techniques. Specifically, this rule identifies the combined use of execution delays (e.g., Start-Sleep, WScript.Sleep, ping/timeout) and environment/sandbox fingerprinting (e.g., WMI queries for ComputerSystem, hypervisor detection, or CPUID) often used by malware to detect virtual environments before executing malicious payloads (typically via IEX or Invoke-Expression).
Detects attempts to disable or flush system firewall rules on Linux platforms using common tools like iptables, ufw, firewalld, and nftables. Adversaries often perform these actions to bypass network controls and facilitate unauthorized communication.
This rule detects suspicious process spawning patterns where cmd.exe appears as a child of svchost.exe, which is indicative of PPID spoofing (often associated with Cobalt Strike's spawn-to and token impersonation techniques). It validates the relationship by checking if the grandparent process is the legitimate services.exe.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
This rule detects potentially malicious activity involving the CredentialUIBroker.exe process or the use of SetWindowsHookEx API calls. These behaviors are often associated with attempts to intercept user input or dump credentials from system processes.
Detects components of the StrikeShark campaign, specifically the staging of SharkLoader payloads within specific AppData subdirectories (%APPDATA%\xwreg or %APPDATA%\xgdf) and the sideloading of a rogue SystemSettings.dll by the legitimate SystemSettings.exe process from an unauthorized location.
Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.
Page 762 of 1168