Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.
This rule detects network connections where the HTTP request URL or specific HTTP cookies match patterns often associated with command and control infrastructure or specific tracking beacons. It triggers on connections to 'financemachinelearning.com/apparatus/wind/twig/statement.html' or requests containing cookies like 'zd_cs_pm' or 'euconsent-v2'.
Detects execution of a process named 'IntelAudioService.exe' located in a user-specific subdirectory under 'IntelAudio\Service\'. This pattern is frequently used by adversaries to masquerade malicious activity by mimicking the naming convention of legitimate Intel audio drivers while executing from non-standard locations.
Detects the ConfigurationRemotingServer.exe process spawning PowerShell or related host processes (pwsh.exe, conhost.exe), which may indicate the abuse of remoting or management services to execute scripts or bypass security controls.
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects execution of 'winget configure' where the configuration file path is missing or incorrectly specified, while still utilizing automated flags like '--accept-configuration-agreements' and '--disable-interactivity'. This pattern may indicate an attempt to run winget configuration with malformed arguments or an attempt to bypass standard configuration input validation.
Detects network beaconing activity associated with the SPECTRALVIPER C2 framework. This rule identifies outbound HTTP GET requests targeting known C2 infrastructure domains and IP addresses, while correlating the traffic with specific browser user agents and cookie patterns indicative of this actor.
Detects modifications to Windows Registry Run keys that are initiated by processes related to the Windows Package Manager (winget), specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, or by PowerShell scripts spawned by these processes. This behavior may indicate an attempt to establish persistence.
This rule detects various indicators of DLL sideloading and process masquerading often associated with threat actor campaigns such as OceanLotus (APT32) and other malicious installers (FireAnt MetaKit). It monitors for specific DLL loads by unsigned or unexpected processes, the execution of masqueraded binaries, and suspicious command-line patterns used to stage malicious payloads.
This rule detects potential exploitation attempts against ServiceNow instances by monitoring network and DNS activity involving a known malicious IP address (51.159.98.241). It identifies high-volume connections or DNS requests related to service-now.com associated with this IP, which may indicate an attacker attempting to leverage unauthenticated Scripted REST resources.
Page 806 of 1168