Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the spawning of shell processes (sh, bash, dash, zsh, ksh) as children of ffmpeg, ffprobe, jellyfin-ffmpeg, or emby-ffmpeg. This behavior is indicative of a successful AVBuffer.free pointer hijack vulnerability (CVE-2026-8461, also known as PixelSmash) being exploited to achieve arbitrary command execution. The rule specifically looks for these parent processes spawning shell children, or if the child process command line contains common shell paths or network-related commands, and filters for specific user accounts often associated with media servers or generic system accounts.
Detects the use of the 'fsutil.exe' utility with the 'setZeroData' argument to perform zero-byte file filling, often used to make files unrecoverable. The rule further filters for command lines containing common file deletion commands like 'del' or network connectivity tests like 'ping', indicating possible malicious file removal or destruction activity.
This rule detects modifications to the Windows Registry that enable the 'Shutdown without logon' feature, which allows a user to initiate a system shutdown without needing to log in first. This setting is often modified by attackers or during unauthorized system reconfiguration to weaken access control or facilitate disruptive activities.
Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.
This rule detects potential VILE ransomware activity by identifying a specific combination of Windows token manipulation APIs (e.g., AdjustTokenPrivileges, DuplicateTokenEx) paired with the usage of VILE-specific direct NT syscalls (NtCreateWaitCompletionPacket, ProcessPrng) within the same process context. This behavioral pairing serves as a high-fidelity indicator of VILE ransomware execution.
Detects the creation of scheduled tasks named 'RageGuard' or utilizing 'win_guard' binary paths in suspicious directories (Temp, AppData, ProgramData), correlated with concurrent registry modifications to Winlogon (Shell/Userinit) or Image File Execution Options (Debugger) using the same binary, indicative of the TrymeLocker ransomware persistence mechanism.
Detects the execution of PowerShell commands intended to suspend BitLocker encryption. Adversaries may attempt to disable or suspend disk encryption to facilitate data exfiltration or to modify protected system files.
Detects execution of the Windows timeout.exe utility from cmd.exe or setup.cmd where the timeout.exe binary is not digitally signed by Microsoft Corporation. This behavior is indicative of potential living-off-the-land (LotL) activity where an attacker attempts to obfuscate or delay execution by utilizing built-in utilities with unsigned versions or repurposed names.
Detects the creation or modification of a registry run key under the 'Run' hive where the target executable is located within a GUID-named subdirectory inside the user's AppData/Local folder. This pattern is commonly used by malicious software to maintain persistence by masquerading as a legitimate browser or application process.
Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.
Page 823 of 1168