Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.
Detects JFMBackdoor activity where a sideloaded fltMC.exe executable located in a temporary directory initiates process enumeration using tasklist.exe or performs service lifecycle management operations (delete, start, stop, create, or query) using the sc.exe utility.
Detects the compromised user granting read/write permissions to a highly privileged, unfamiliar third-party application via the OAuth consent framework. Specifically looks for 'Consent to application' operations where granted permissions include 'Mail.ReadWrite', 'Contacts.Read', or 'offline_access'.
Detects host reconnaissance activity where the zlrenu8.exe process (associated with the NUKESPED backdoor/Kimsuky threat group) attempts to enumerate sensitive registry keys under HKLM\SOFTWARE and HKLM\SYSTEM. This behavior is indicative of post-exploitation discovery activities.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
This rule detects potential Server-Side Request Forgery (SSRF) activity by identifying suspicious patterns in web application access logs. It monitors for high-diversity parameter values within URL query strings (e.g., 'url', 'path', 'target', 'file', 'src', 'dest', 'uri', 'redirect') that deviate from normal behavior, combined with indicators like mixed HTTP response codes (2xx and 4xx) and high request volumes from a single source IP to a specific request path. Such behavior is characteristic of an adversary iteratively probing or brute-forcing internal paths or resources via an application-level vulnerability.
Detects process enumeration activities (tasklist, wmic, or command line process listing) performed by fltMC.exe. This pattern is characteristic of JFMBackdoor, which utilizes DLL side-loading through fltMC.exe to maintain persistence and perform situational awareness.
Detects high-volume outbound network connection attempts from internal endpoints targeting a specific set of common SOHO/IoT management and service ports. This behavior is consistent with automated service enumeration, banner grabbing, and reconnaissance activity often associated with botnets like the JDY cluster, which target edge devices for potential exploitation.
Detects Server-Side Request Forgery (SSRF) attempts directed at the Google Cloud Platform (GCP) instance metadata service endpoints. The rule monitors HTTP request logs from proxies or web servers, identifying requests that contain suspicious metadata hostnames or IP addresses combined with sensitive API paths typically used for exfiltrating cloud instance identity tokens.
Page 814 of 1168