Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound network connections to port 8084 initiated by processes originating from suspicious directories such as AppData, Temp, or ProgramData. This behavior is indicative of VSHELL RAT leveraging WebSocket-based C2 communication, a technique observed in UNC5221 SNOWLIGHT campaigns.
Detects behavior associated with TrymeLocker ransomware, specifically the removal of critical Windows components like cmd.exe. The rule monitors for the sequence of taking file ownership using takeown.exe, modifying file permissions with icacls.exe to grant full access, and subsequent deletion of the file using del commands. It also identifies Sysmon file deletion events targeting cmd.exe within system directories by non-system processes.
This rule detects the execution of a process named 'wusvc.exe' that is masquerading as the legitimate Windows Update Service. The detection logic identifies instances where the executable is located outside of the standard Windows System32 or SysWOW64 directories and is not spawned by a legitimate parent process (svchost.exe or services.exe), which is indicative of the SNOWLIGHT dropper associated with the UNC5221 threat actor.
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.
This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.
Detects a coordinated persistence effort by a single process, involving the creation of a scheduled task, modification of the HKCU Run registry key, and modification of the Active Setup registry key within a 5-minute window. This behavior is indicative of a complex persistence mechanism typically associated with malicious software.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
Detects anomalous behavior associated with the TrymeLocker watchdog loop, characterized by high-frequency registry modifications to Windows Policy restriction keys paired with rapid mass creation of executable files in common system directories within a short window.
Page 764 of 1168