Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential malicious activity including unsigned processes performing cross-process injection into common system processes, suspicious sideloading of 'vulkan-1.dll' from non-standard locations, and execution of unsigned binaries from user-writable directories like Temp, AppData, or ProgramData.
Detects the execution of systeminfo.exe or wmic.exe for hardware and operating system discovery when initiated by a process located in user-writable or temporary directories, such as AppData, Temp, ProgramData, or Downloads. This behavior is characteristic of post-infection reconnaissance by malware loaders or RATs.
Detects instances where critical Windows system processes (svchost.exe or lsass.exe) spawn suspicious child processes. This pattern often indicates process injection or unauthorized activity where an adversary uses these legitimate, high-privileged processes as a parent to execute malicious payloads, bypass security controls, or maintain persistence.
This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.
Detects the creation of suspicious scheduled tasks by monitoring Windows Event Logs (EventCode 4698) for task XML content and process creation events (EventCode 1) for the 'schtasks.exe' utility. The rule identifies tasks created in user-writable paths (like AppData or Temp), tasks containing suspicious keywords like 'hidden' or specific Mozilla update patterns, tasks configured to run as SYSTEM, and tasks spawned by non-standard parent processes.
Detects the execution of QEMU binaries or the utilization of .qcow2 disk files. The rule flags these activities as higher risk when they occur within common user-writable or temporary directories, which is a common indicator of unauthorized virtualization usage, staging for side-loading, or attempts to hide malicious artifacts within virtual disks.
This rule detects the execution of suspicious file types (exe, dll, bat, cmd, vbs, js, ps1) originating from common extraction or user-writable locations like Downloads, Temp, or Roaming AppData directories. The rule specifically flags processes spawned by common archive utilities (winrar.exe, 7zFM.exe, 7zG.exe) or Windows Explorer, with an additional risk assessment if the command line arguments suggest recruitment or financial lure themes.
Detects Atlas RAT and ValleyRAT patterns involving process injection into svchost.exe or explorer.exe by an unauthorized process originating from a user-writable directory (e.g., Temp, AppData, Downloads). The rule correlates process injection events with preceding suspicious process launches.
Detects DNS resolution attempts or direct network connections to the domain 'vtps.us', which is associated with TA4922 command and control (C2) infrastructure.
Detects process hollowing behavior indicative of the Atlas RAT loader used by TA4922. The rule monitors for the spawning of svchost.exe or notepad.exe by non-standard parent processes located outside legitimate system directories, which is a common indicator of process injection and masquerading techniques.
Page 796 of 1168