Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,596 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
Detects BQT.exe or start.exe performing activities indicative of sandbox or virtual machine environment evasion. This includes querying registry keys related to virtualization artifacts, spawning system information tools like wmic.exe, systeminfo.exe, or reg.exe, and enumerating processes associated with virtualization software like vmtoolsd.exe, vboxservice.exe, or vboxtray.exe.
Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.
Detects activity associated with the unauthorized copying of sensitive system files (e.g., NTDS.dit, SAM, SYSTEM) using Volume Shadow Copy, or the use of Rclone for potential data exfiltration via SFTP, copy, or sync operations.
Detects the execution of FTK Imager (FTKImager.exe), a forensic imaging tool that can be used by adversaries to perform data collection, including capturing physical memory, logical drives, or disk images from a local system.
Detects processes that access a threshold of five or more sensitive configuration, credential, or browser-stored login files within a single execution context, which is indicative of credential harvesting or automated collection activity.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects the creation of a scheduled task masquerading as a legitimate Mozilla maintenance task (UpdateTask or ElevateTask). The rule specifically flags when such tasks are configured to run as SYSTEM, triggered on system start, and are created via a command line executed by a parent process of cmd.exe, which is indicative of Payouts King ransomware persistence activity.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
Page 798 of 1168