Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects two primary indicators of potentially malicious activity involving the Windows Explorer process: 1) Suspicious process parentage, where explorer.exe is spawned by a parent other than the standard winlogon.exe, userinit.exe, or explorer.exe, or where explorer.exe spawns unusual child processes like cmd.exe, powershell.exe, or others. 2) Possible Parent PID (PPID) spoofing, identified by the presence of specific API-related keywords in the command line (e.g., SeImpersonatePrivilege, CreateProcessWithToken) within process creation events.
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
This rule detects potentially malicious web traffic involving a redirect chain associated with HolaBrief and LoopedIn services, which are sometimes leveraged in phishing campaigns or credential harvesting. It identifies multi-hop redirect chains and connections to known suspicious IP addresses (217.182.211.237).
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Detects the execution of cmd.exe spawned by processes running from suspicious directory paths such as %TEMP%\aswerf\, %APPDATA%\xwreg\, or %APPDATA%\xgdf\. These paths are commonly associated with dropper activity or malicious payloads. The rule specifically monitors for command lines containing '.pdf', suggesting the potential opening of a lure document.
This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.
Detects the use of well-known tools and techniques to dump the memory of the Local Security Authority Subsystem Service (LSASS), which is a common method for harvesting Windows credentials.
This rule detects PowerShell or pwsh processes executing commands that contain the string 'autogenstudio' combined with a base64-encoded or obfuscated command pattern. This behavior is indicative of an adversary attempting to execute obfuscated scripts or payloads associated with the Autogenstudio application or using it as a camouflage.
This rule detects potential malicious activity involving the 'wusvc.exe' executable. It flags instances where 'wusvc.exe' is executed from the user's Downloads folder or other non-standard paths, particularly when the file size is abnormally small (less than 100KB), which is indicative of masquerading or a dropper payload. The rule also checks for a known malicious file hash associated with the Snowlight dropper.
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Page 820 of 1168