Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
Detects high-frequency file creation or modification events within directories matching the 'RP_<UUID>' naming pattern in Windows temporary folders. This behavior is indicative of Poseidon generator/worker threads attempting to cause I/O saturation to exploit Time-of-Check Time-of-Use (TOCTOU) vulnerabilities in security products like Microsoft Defender (MsMpEng.exe).
Detects unauthorized modifications to cron jobs or RC scripts on Linux and BSD edge appliances, which is a persistence technique observed in the VerdantBamboo BRICKSTORM campaign. The rule flags suspicious file modifications in persistence-related directories, excluding activity from legitimate package managers.
This rule detects potentially malicious activity involving the Windows Error Reporting service (wermgr.exe). It monitors for two primary conditions: 1) Execution of wermgr.exe from a location other than the standard System32 directory, indicating potential binary masquerading. 2) wermgr.exe spawning common command-line shells (cmd, powershell, etc.) while running under the SYSTEM account, which is indicative of potential task abuse or privilege escalation.
Detects suspicious access to wermgr.exe involving Alternate Data Streams (ADS) using the WDFOO tag, or access via Volume Shadow Copy (VSS) paths, often indicative of exploitation attempts related to CVE-2026-50656 where an adversary uses oplocks for race conditions against Windows Defender.
This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
Page 793 of 1168