Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of scheduled tasks using schtasks.exe that exhibit indicators associated with StrikeShark SharkLoader or Cobalt Strike persistence. Indicators include task actions that reference rundll32 with a DLL, execution from user-writable directories (AppData, ProgramData, Temp), the use of base64-encoded command lines, or specific task names mimicking OneDrive updates.
Detects the loading of known hooking libraries (MinHook or Microsoft Detours) or SharkLoader-specific components (SyncRes.dat) into non-system processes, followed by the staging of payload components in user directories. This behavior is indicative of malware attempting to intercept critical system APIs (such as VirtualAlloc and Sleep) to evade memory scanning and analysis by EDR solutions.
Detects the execution of 'net.exe' or 'net1.exe' to create a new user account with a prefix indicative of potential persistence or backdooring (rage_master_). The rule further filters for executions originating from suspicious directories such as \Temp\, \Users\Public\, or \ProgramData\, which are common staging areas for malicious binaries.
Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.
This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.
Detects the creation of a Windows scheduled task using 'schtasks.exe' that triggers on system startup or login, while simultaneously referencing specific keywords ('RageGuard', 'win_guard_', 'RageCore_') in the command line, suggesting the persistence of a specific malicious utility.
Detects multiple execution attempts of common Windows built-in utilities (bcdedit, vssadmin, wbadmin, wmic) used to disable recovery features or delete volume shadow copies within a 5-minute window. This behavior is highly characteristic of ransomware or destructive malware aiming to prevent system recovery.
Detects modification of the Windows Registry 'Shell' value within the Winlogon key to an executable other than 'explorer.exe'. This technique is commonly used by malware, such as TrymeLocker, to achieve persistence by replacing or augmenting the default Windows shell with a malicious payload that executes upon every user login.
Detects the creation of a local user account followed immediately by the addition of that same account to the local Administrators group using the built-in Windows net.exe or net1.exe utilities. This pattern is commonly observed during adversary post-exploitation activity to establish persistence or escalate privileges.
Detects Android applications exhibiting multiple sensitive behaviors simultaneously within a 5-minute window, such as screen recording, audio capture, GPS tracking, and unauthorized access to SMS, call logs, or contacts. This behavior is strongly indicative of malicious mobile spyware.
Page 763 of 1168