Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Detects the execution of node.exe from common user-writable or non-standard directories such as AppData, Downloads, Temp, ProgramData, or Desktop, accompanied by JavaScript file arguments. This behavior is indicative of the TonRAT campaign which uses a portable Node.js runtime to execute malicious JavaScript payloads in a stealthy manner, bypassing standard installation path detection.
Detects execution of SoftEther VPN binaries (vpnclient, vpnserver, vpncmd, vpnbridge) from non-standard directories such as ProgramData, Temp, or AppData. It also identifies masquerading attempts where these binaries are renamed to vmtools.exe or vmwared.exe, and detects execution with specific VPN client/server command line flags outside of the expected installation directory. This rule is designed to identify covert tunneling activities and potential persistence mechanisms used by threat actors.
Detects browser/node subprocesses spawned by AutoGen/Python processes making loopback WebSocket connections to the AutoGen Studio MCP control plane, which is indicative of the AutoJack exploit chain. This rule specifically looks for Python processes associated with 'autogen' or 'autogenstudio' that initiate network connections to loopback addresses on ports 8080 or 8081, often with specific URL paths related to the MCP WebSocket API.
Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.
Detects instances where mshta.exe is used to launch suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe, or is associated with HTA files or PteroSand-related indicators. This behavior is indicative of HTML smuggling or malicious HTA-based delivery of secondary payloads.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects the creation or modification of suspicious LaunchAgent or LaunchDaemon plist files on macOS. Specifically looks for files named 'com.apple.accountsd.plist' or files within a hidden directory '.com.apple.accountsd' in common LaunchAgent/Daemon paths. This pattern is often used by malware for persistence.
Detects attempts to inject attacker-controlled credentials into Entra ID Agent Blueprints via the Microsoft Graph addPassword endpoint. This activity is identified by monitoring Microsoft Graph activity logs for 'addPassword' requests and correlating with Audit Logs for 'Add password' operations targeting resources containing 'blueprint' or 'Blueprint', or where modified properties include 'Blueprint Secret', 'passwordCredential', 'addPassword', or the actor has the 'Agent ID Administrator' role.
Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.
Page 790 of 1168