Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of a local administrator account or modification of the Administrators group through ConfigurationRemotingServer.exe. This activity is associated with the DSCourier persistence technique, which leverages Windows PowerShell Desired State Configuration (DSC) to maintain unauthorized administrative access.
Detects instances where ConfigurationRemotingServer.exe spawns sc.exe, which is indicative of Windows service creation or modification occurring via WinGet Desired State Configuration (DSC) abuse to establish persistence.
Detects instances where the Windows Subsystem for Linux (WSL2) wsl.exe process is used to execute curl or wget from the Windows host. This technique is often used to stage payloads or download tools from the internet, effectively bypassing Windows-based EDR network monitoring as the network connection occurs within the isolated WSL2 environment.
Detects the execution of child processes by wsl.exe. Attackers may use the Windows Subsystem for Linux (WSL2) to execute code, stage payloads, or initiate network connections within the isolated WSL2 VM environment, potentially bypassing Windows-based endpoint monitoring and network security controls.
Detects file modification or creation events affecting critical authentication components, specifically Pluggable Authentication Modules (pam_unix.so) and OpenSSH binaries (sshd, ssh, scp). Such activity is highly indicative of an attempt to backdoor the authentication process to facilitate unauthorized access or credential theft, as observed in Operation Highland.
This rule detects the execution of Windows Subsystem for Linux (WSL) components, including wsl.exe, wslhost.exe, and wslservice.exe. WSL can be leveraged by adversaries to execute malicious code within a Linux environment on a Windows host, potentially bypassing Windows-specific security controls.
Detects the modification or creation of shared object files (.so) within common Linux Pluggable Authentication Modules (PAM) directories. Adversaries often modify these modules to establish persistence, capture credentials, or create backdoors for authentication bypass.
This rule detects activities related to the Windows Subsystem for Linux (WSL2), including the execution of wsl.exe, wslhost.exe, or wslservice.exe, as well as the active presence of the vmmemWSL virtual machine process. Monitoring WSL2 activity is important as adversaries can use the Linux environment to bypass traditional Windows security controls, execute Linux-native tools, or maintain persistence.
Detects attempts to access the GCP instance metadata service (metadata.google.internal) by exploiting Server-Side Request Forgery (SSRF) vulnerabilities. The rule looks for URI patterns often used to bypass filters by manipulating the authority component or using specific protocols like 'gcs://' to target internal cloud infrastructure.
Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.
Page 809 of 1168