Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for the execution of 'wusvc.exe' (a potential disguise for malicious binaries) when performed by users or on hostnames containing keywords associated with security research, sandboxing, or testing such as 'sandbox', 'malware', 'virus', or 'sample'.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
Detects file write or delete operations involving cmd.exe by processes potentially associated with the TrymeLocker ransomware, specifically looking for indicators of ownership or permission modification (takeown, icacls) and suspicious file paths.
Detects the use of native Windows utilities (icacls.exe, cacls.exe, takeown.exe) to modify file or directory permissions or ownership in a manner consistent with adversarial activity. This includes granting full permissions to everyone/administrators, or changing ownership of critical system directories (e.g., windows, system32) to standard user accounts. The rule includes logic to filter out known legitimate administrative processes and flags potential suspicious parent processes.
This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.
This rule detects potential command and control (C2) activity associated with the SNOWLIGHT framework by identifying outbound WebSocket connections over HTTP to a specific known C2 IP (38.60.253.35) and port (8084). It correlates network flow logs (CommonSecurityLog) containing specific HTTP URL parameters (a=w64, t=ws_, p=8084) with EDR process network events (DeviceNetworkEvents) where the Windows Update Service process (wusvc.exe) is the initiator, indicating potential process masquerading or injection.
Detects potential persistence attempts by TrymeLocker malware, specifically monitoring for malicious StubPath values written to Active Setup registry keys. The rule correlates this behavior with other indicators of compromise such as malicious Debugger values set within Image File Execution Options (IFEO) keys or suspicious service creation, effectively identifying high-confidence persistence activity.
Detects processes located outside of standard Windows system directories (System32 and SysWOW64) that load the advapi32.dll library. Advapi32.dll is a core Windows API library frequently used for security-related functions, including service control and registry manipulation; its loading by non-system binaries can be indicative of masquerading or malicious activity.
Detects the modification of Image File Execution Options (IFEO) registry keys for Windows accessibility binaries (e.g., sethc.exe, utilman.exe). Adversaries frequently use this technique to hijack these binaries to launch a command shell with SYSTEM privileges when triggered from the login screen.
Detects suspicious execution patterns involving Windows file management utilities (takeown.exe, icacls.exe) or the deletion of command-line interpreter binaries through cmd.exe. These patterns are often associated with unauthorized modifications of file permissions or attempts to clear forensic evidence during an intrusion.
Page 822 of 1168