Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects multiple concurrent attempts to inhibit Windows system recovery, a common behavior observed in the TrymeLocker ransomware family. The rule triggers when at least two distinct malicious activities occur on the same host within a 120-second window, including the disabling of the Windows Recovery Environment (WinRE) via bcdedit, deletion of shadow copies via vssadmin or wmic, disabling of the Windows backup service (wbengine) via sc, or disabling of System Restore via registry modification.
Detects the execution of cmd.exe with arguments that combine 'fsutil volume setZeroData' (often used to corrupt or delete data) and 'del /f' (forced file deletion) in a single command line, likely indicating malicious file cleanup or anti-forensics activity.
Detects the modification of the 'Debugger' registry value for 'agntsvc.exe' under the Image File Execution Options (IFEO) registry key. This technique is often used by adversaries for persistence or to intercept and manipulate process execution by forcing a specified program (in this case, 'Systray.exe') to run when 'agntsvc.exe' starts.
Detects modifications to the Windows Registry value 'ShutdownWithoutLogon' within the 'Policies\System' key. Setting this to '0' prevents users from shutting down the machine without first logging on, which can be a technique used to alter system behavior or maintain specific logon states.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.
Detects behavior consistent with the Pay2Key ransomware, which checks for the presence of Avast security software directories, verifies SYSTEM account access via registry queries, and performs subsequent DLL sideloading by dropping 'powrprof.dll' into the Avast application folder.
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
Page 765 of 1168