Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential timestomping activity using PowerShell Set-ItemProperty, as well as specific file metadata manipulation and file operations associated with the JFMBackdoor utilizing fltMC.exe.
Detects the suspicious execution of fltMC.exe or the loading of FLTLIB.dll from temporary directories, which is a known behavior of JFMBackdoor malware. It also detects known SHA256 hashes associated with this threat.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Detects the execution of the NUKESPED backdoor (specifically the file named zlrenu8.exe), which is associated with Kimsuky's espionage operations, including screen capture activities.
Detects fltMC.exe initiating outbound network connections, which is anomalous behavior indicative of potential JFMBackdoor activity (associated with Red Lamassu/Calypso) utilizing DLL sideloading or reverse shell execution.
Detects the Showboat Linux malware which hides its presence by masquerading as a kernel worker process. This is identified by a process with 'kworker' in its name or command line that originated from a resolvable on-disk binary path, which is characteristic of user-space processes rather than legitimate kernel threads.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
Page 813 of 1168