Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,597 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.
Detects the execution of Python processes with command-line arguments indicative of keylogging activity (e.g., pynput, keyboard, keylog) or Python processes creating/writing to files with names suggesting keylogging behavior (e.g., log.txt, keylog). This rule targets potential data collection via keyboard interception by monitoring process creation and file write events.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects process execution patterns associated with OceanLotus (APT32) SPECTRALVIPER sideloading chains. The rule identifies suspicious executables by name (masquerading), specific command-line flags ('-uiDll'), execution from known staging directories, or binaries using spoofed vendor metadata with invalid or absent digital signatures.
This rule detects the creation or modification of executable files (.exe or .dll) on hidden Windows administrative shares (e.g., ADMIN$, C$, D$, IPC$), followed by the execution of a process with the same file hash on a different host within a one-hour window. This behavior is indicative of lateral movement using SMB shares to stage and execute malicious payloads.
Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.
This rule monitors network connections initiated by a process named 'setup.exe' to known malicious or suspicious IP addresses. Legitimate installers should not be initiating network connections to these specific external addresses.
This rule monitors and alerts on network connections established from endpoints to a predefined list of known malicious IP addresses, which may indicate command-and-control (C2) communication or unauthorized exfiltration attempts.
Page 805 of 1168