Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,596 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts by processes, such as Python or PyInstaller-compiled binaries, to perform in-memory patching of the 'EtwEventWrite' function within 'ntdll.dll'. This technique is used to bypass Event Tracing for Windows (ETW) and suppress security telemetry, a tactic observed in campaigns like Glove Stealer.
Detects the execution of a PyInstaller-compiled payload associated with the Yuta/Glove Stealer campaign. The rule monitors for processes launching from temporary _MEI* extraction directories within %APPDATA% or %TEMP%, and specifically identifies the winupdate.exe payload within .cache subdirectories.
Detects instances where known Windows binaries frequently abused for User Account Control (UAC) bypass (fodhelper.exe, eventvwr.exe) spawn unexpected child processes. These binaries are trusted system utilities that, when used as an actor for launching other processes, often indicate malicious activity aimed at privilege escalation.
Detects malicious scheduled task activity attributed to the Payouts King threat actor. The rule monitors for the creation, execution, and deletion of tasks using specific naming conventions ('Mozilla\UpdateTask', 'Mozilla\ElevateTask') or patterns (e.g., /ru SYSTEM, /sc ONSTART) executed by non-standard parent processes.
Detects sensitive Active Directory replication operations (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by accounts other than standard domain controllers. This behavior is a common indicator of DCSync attacks, where an adversary mimics a domain controller to request sensitive Active Directory data, such as password hashes, from a legitimate domain controller.
Detects multiple host enumeration techniques indicative of pre-encryption discovery activity. The rule monitors for the sequential or combined use of tasklist.exe, PowerShell Get-Process, cmd dir /s, and findstr.exe on a single host within a 30-minute window, which is a common behavior pattern for various ransomware strains.
Detects instances where the LINE messaging application (LINE.exe) initiates child processes commonly associated with malware delivery, such as command-line shells, script interpreters, and archive utilities. This pattern is often indicative of TA4922 activity, which leverages themed lures (HR, payroll, tax) delivered via the platform to execute malicious payloads.
Detects DLL sideloading activity linked to Obsidian Sandstorm campaigns. It identifies legitimate, signed processes loading unsigned DLLs from non-standard, user-writable directories (such as Temp, Downloads, or Desktop) or the same directory as the executing process, specifically monitoring for indicators associated with malware families like ThrottleDrift and SilverGorilla.
Detects the rapid termination of multiple known security/EDR agent processes on a single device within a short 5-minute window. This behavior is often indicative of malicious activity, such as ransomware or an attacker attempting to impair defensive capabilities before proceeding with malicious operations.
Detects the execution of QEMU binaries (qemu-system-x86_64, qemu-img, qemu-system-i386, qemu-system-aarch64) when launched from parent processes that are not standard virtualization or emulation management tools. This can indicate the use of QEMU for malicious purposes, such as unauthorized virtual machine execution, persistence, or secondary staging on a compromised host.
Page 794 of 1168