Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for processes that establish a network connection to specific Cloudflare IP address ranges (104.21.0.0/16 and 172.67.0.0/16) within a 5-minute window. This can be indicative of communication with command and control infrastructure, proxies, or content delivery networks used by adversaries.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
Detects potential User Account Control (UAC) bypass attempts using known techniques involving the execution of fodhelper.exe or eventvwr.exe, or by abusing the Mozilla ElevateTask task scheduler configuration.
Detects a DLL being loaded into a system process (e.g., Windows/System32, Program Files) from a suspicious or user-writable directory (e.g., AppData, Temp, Downloads), followed by a network connection originating from the same process within a 10-minute window. This behavior is indicative of DLL side-loading used to execute a payload that subsequently initiates C2 communication.
Detects an executable or file running from a common temporary or user-writable location (e.g., AppData, Temp, ProgramData) that is followed within two hours by a modification to a Windows 'Run' registry key referencing a file in the same suspicious directory structure.
This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Detects the execution of Python interpreters from suspicious or user-writable locations such as Temp, Downloads, or AppData directories. The rule explicitly excludes known legitimate development and coding environments, focusing on potential malicious script execution, often associated with droppers or secondary payloads that are not managed by typical IDEs or development tools.
Detects Python-based execution of system binaries (wmic.exe, reg.exe, tasklist.exe, systeminfo.exe) used for environment reconnaissance, specifically targeting VM and sandbox detection artifacts characteristic of the SilentRunLoader malware.
Detects network activity and DNS queries associated with known TA4922 command-and-control infrastructure, including specific domains and IP addresses. It also employs behavioral analysis to identify beaconing patterns from processes that are not identified as standard web browsers or authorized system/application utilities.
Page 795 of 1168