Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,596 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network connection events initiated by the OneDrive sync process (OneDrive.Sync.Services.exe) to known malicious domains or suspicious specific file paths, which may indicate unauthorized use of the OneDrive process for command-and-control communication or malicious file retrieval.
Detects instances where the SQL Server process (sqlservr.exe) spawns suspicious child processes, which is a common indicator of Remote Code Execution (RCE) exploitation. This includes the execution of command shells (cmd, powershell), web clients (curl, wget), and other utilities commonly used for post-exploitation staging and payload delivery, such as those associated with potential xp_cmdshell abuse.
This rule detects abnormal process execution chains involving DSCourier.exe invoking the Windows Package Manager (WinGet) DSC engine components (WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe) via COM API, bypassing the standard winget.exe parent process. This behavior is indicative of potential process hollowing, evasion, or malicious use of built-in system management tools.
Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.
Detects anomalous HTTP POST requests to the '/V1/Update/GetUpdate' endpoint on an MSSQL-hosted application, which is associated with malicious activity linked to the OceanLotus (APT32) threat actor group, specifically the Blazing Furnace campaign.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.
Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.
Page 807 of 1168