Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.
Detects specific DLL sideloading patterns associated with the OceanLotus (APT32) group, specifically involving the SPECTRALVIPER loader. The rule monitors for known masqueraded binaries (e.g., intelaudioservice.exe, genuine.exe) loading suspicious files or executing with specific command-line arguments (e.g., -uiDll, /appmodel) indicative of malicious sideloading and persistence mechanisms.
This rule detects suspicious activity involving 'IntelAudioService.exe' and the potential sideloading of 'DtlCrashCatch.dll'. It flags instances where 'DtlCrashCatch.dll' is loaded as a module or when 'IntelAudioService.exe' is executed with specific command-line arguments (e.g., 'appmodel', 'staterepository', 'service') that may indicate abnormal service behavior or potential sideloading attempts.
Detects the creation or modification of Windows Registry Run keys, which are common persistence mechanisms, by processes related to Desired State Configuration (DSC) (e.g., ConfigurationRemotingServer) or the Windows Package Manager (winget, WindowsPackageManagerServer). This rule flags entries in HKLM or HKCU Run keys created by these specific administrative or provisioning processes.
Detects the execution of common enumeration and discovery commands (e.g., cmd, powershell, tasklist, net, whoami) when launched by specific background services such as OneDrive Sync or Intel Audio Service. This behavior is atypical for these processes and may indicate process injection or unauthorized activity using legitimate service binaries as a proxy.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
This rule detects potentially malicious HTTP POST requests directed at a specific URI path ('/V1/Update/GetUpdate') associated with software update functionality. It identifies suspicious traffic by analyzing parameters in the request body (such as Id, Hostname, Mac, Version, Arch) and potential process names (e.g., setup.exe, IntelAudioService.exe). High-risk scores are assigned based on the destination IP and the presence of these specific identifying parameters, which may indicate command-and-control (C2) beaconing or data exfiltration masquerading as legitimate update check traffic.
Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.
Detects potential lateral movement activity associated with the SPECTRALVIPER actor by monitoring OneDrive.Sync.Service.exe for the initiation of named pipe connections. The detection specifically targets anomalous orchestration patterns using the XGU::Feature::Pivot Shadow module and XGU::Pivot::StartLink, which utilize named pipes for inter-process communication across systems.
This rule detects potential lateral movement and privilege escalation activity associated with the SPECTRALVIPER framework. It identifies suspicious process launch events where method names indicative of token manipulation (e.g., StealToken, MakeToken, Impersonate_ThisThread) are present in the command line, or where the OneDrive Sync Service process is used as an indicator of this specific activity.
Page 808 of 1168