Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of notepad.exe where the command line arguments reference a file path located in 'C:\temp\' and include a filename typical of ransomware notes, such as 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware displaying instructions to the victim after file encryption.
Detects the creation or modification of the 'shutdownwithoutlogon' registry value to '0' within the Windows System Policies registry key. This registry value controls whether the shutdown option is displayed on the logon screen; setting it to 0 disables this option, which can be an indicator of an adversary attempting to restrict system access or configure the environment for a specific post-compromise state.
Detects high-volume file modification or renaming operations targeted at specific file extensions (dcm, tf, parquet) commonly associated with sensitive data (DICOM imaging, Terraform states, database parquet files) or operations occurring within Docker volume directories. The detection uses an aggregation logic to identify when a process performs more than 20 such file operations on an endpoint, which may indicate bulk data exfiltration, encryption, or tampering.
Detects execution and activity associated with the Grixba infostealer (often linked to Play Ransomware / Jumpy Pisces operations). The rule monitors for the execution of 'GT_NET.exe' from suspicious locations like 'C:\Users\Public\Music\', the loading or creation of the 'inf_g.dll' modular payload, and identifies a specific known Grixba v3 SHA-256 hash.
This rule detects the Python-based CastleLoader malware establishing persistent WebSocket (wss:// or ws://) command-and-control channels to randomized attacker endpoints. It specifically looks for network connections initiated by python.exe or pythonw.exe to URLs matching a WebSocket pattern, with at least 3 connections within a 5-minute window.
Detects various phases of the Grixba infostealer infection lifecycle, including persistence via file drops in public user directories, malicious DLL/payload creation, reconnaissance data exfiltration, security software tampering (Windows Defender, AMSI, WLDP), and event log clearing via wevtutil.
This rule detects potential ransomware activity by monitoring for the deliberate inhibition of Windows system recovery features (via vssadmin, wmic, or bcdedit) and the subsequent staging of archived data in public user directories.
Identifies geographic impossible travel where the device code was requested in one country and successfully authenticated from another within minutes. This rule looks for a single AccountUpn having activity from two or more distinct locations within a 10-minute window.
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
Page 766 of 1168