Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects the Windows UAC consent.exe process loading msimg32.dll from a non-standard, potentially user-writable location, a technique associated with BumbleBee malware campaigns for DLL sideloading. The rule further inspects the parent process context to ensure consent.exe was launched by an expected parent (svchost.exe) and validates the DLL's signature.
Detects the execution of the AdaptixC2 agent (AdgNsy.exe) from AppData\Local directories and its subsequent internal network scanning activity against sensitive ports (445, 3389, 5985). The rule also monitors for potential dropper patterns associated with the Bumblebee loader, specifically involving processes like consent.exe or msiexec.exe dropping the binary.
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
This rule detects the deployment and execution of the RustDesk remote access tool in conjunction with potential staging of installation artifacts and observed prior activity related to BumbleBee/Adaptix C2. It correlates process execution, file creation, and network connectivity to the RustDesk relay infrastructure to assign a risk score, helping identify potential unauthorized remote access or malicious persistence.
Detects non-interactive OAuth2 token refresh attempts targeting Microsoft 365 services where the authentication is satisfied by a pre-existing session without MFA challenge. The rule flags instances where the sign-in originates from an IP address with a different ASN or country than the user's previous interactive session and uses specific browser user-agents identified in known Adversary-in-the-Middle (AiTM) campaigns like the Payroll Pirate.
This rule detects Adversary-in-the-Middle (AiTM) session hijacking against Microsoft 365, specifically targeting the Tycoon 2FA phishing kit (associated with campaigns like Payroll Pirate). It correlates two distinct malicious behaviors: the initial MFA capture phase (involving specific error codes and spoofed user agents) and subsequent illicit token replay against the Microsoft Graph API from unmanaged devices.
Detects registry SetValue events targeting Chrome, Edge, or Chromium extension storage keys by processes not associated with official browser updaters or installers. This rule identifies the initialization phase of StegoAd malware (associated with the DarkSpectre campaign), where a first-run timestamp is written to the registry to establish a 3-5 day dormancy period before the extension activates its steganographic payload retrieval functionality.
Page 774 of 1168