Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.
Detects DLL side-loading behaviors associated with the Grandoreiro banking trojan. The rule identifies malicious DLLs compiled with Delphi/Embarcadero, utilizing sgcWebSockets for C2 communication via WebRTC, and including specific anti-analysis and banking-related strings, often executed via legitimate software binaries.
Detects the installation of the BTMOB Android RAT by identifying sideloaded application installations combined with the enablement of sensitive features such as Android Accessibility Services, device administrator registration, or the granting of high-risk permissions (SMS, camera, audio recording) typically used by mobile banking trojans.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects the presence and execution of the 'mybb_limited_acp_to_admin' PoC script, as well as suspicious child process creation originating from web server or PHP processes when the command line includes 'admincp'. This is indicative of potential web exploitation or the use of a web shell within the MyBB Administrative Control Panel environment.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects DNS lookups or network connections from common web browsers to known malicious or suspicious domains (short.gy and chongdaotang.net), which are associated with legal-threat lure phishing campaigns designed for credential harvesting.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.
This rule detects the execution of VBScript files using wscript.exe or cscript.exe that are closely followed by network connections to known public IP geolocation services (ip-api.com, ipinfo.io, api.country.is). It further enhances the detection by checking if a secondary process is spawned from the same host, which may indicate a payload retrieval or execution phase typical of malware staging.
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
Page 778 of 1168