Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,596 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized processes attempting to access browser-stored credential files (Chrome, Edge, and Firefox) such as 'Login Data', 'Cookies', 'Local State', and 'logins.json'. The rule filters known browser processes and common password manager applications to reduce noise from legitimate software that manages or accesses these files.
Detects potential DLL side-loading activity associated with TA4922 RomulusLoader, where an unsigned or invalidly signed DLL is loaded by an application from a user-writable directory. This behavior often indicates an attempt to hijack the DLL search order by placing a malicious DLL in a directory commonly used for non-privileged execution.
Detects IronWorm rootkit activity on Linux, specifically focusing on cases where npm or node processes spawn tools like bpftool, insmod, or modprobe to load eBPF programs or kernel modules. It also flags the usage of specific IronWorm-associated filenames (q2.bpf, libbpf) within directories managed by npm or node.
Detects BQTLock ransomware (BaqiyatLock) establishing persistence by creating scheduled tasks via schtasks.exe. The detection monitors for scheduled task creation commands initiated by the ransomware payload (BQT.exe) or its loader (start.exe), specifically targeting tasks that execute files from high-risk paths like AppData or Temp, or directly reference BQT.exe.
Detects BQTLock ransomware (BQT.exe) identifying and exfiltrating captured desktop screenshots via the Telegram Bot API 'sendPhoto' endpoint. The rule monitors network connections initiated by the identified malware process to api.telegram.org.
This rule detects the creation of scheduled tasks that are configured with high-privilege execution levels (SYSTEM or highest) or that reference suspicious file paths and filenames commonly associated with persistence mechanisms or VM image masquerading (e.g., QEMU files, .qcow2, vault.db). It monitors both command-line execution of schtasks.exe (Sysmon Event ID 1) and Task Scheduler configuration events (Windows Event ID 4698).
Detects BQTLock ransomware activity by monitoring for mass file encryption events (file extensions .bqtlock or .baqiyatlock) and the creation of associated ransom note files (README.bqtlock or HOW_TO_DECRYPT.txt) using Sysmon and Windows Security Event logs.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Detects suspicious activity within GitHub Actions, identifying potential exfiltration or malicious automation by correlating signals such as masquerading actors (e.g., bots like dependabot), specific IronWorm-associated commit message patterns, usage of secrets-related JSON expressions in logs, and the use of innocuous file names for artifact uploads.
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
Page 799 of 1168