Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious Registry value modifications under HKEY_CURRENT_USER\SOFTWARE by processes like svchost.exe or iexplore.exe, involving specific keys associated with configuration (exepath, WD, FR, licence). This behavior is indicative of potential malware persistence or configuration manipulation.
Detects cross-process injection activity targeting Internet Explorer related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for unauthorized processes that are not signed by trusted publishers (Microsoft, Google, Mozilla) performing injection-like behavior, typically associated with Remcos RAT and its use of techniques such as process hollowing or thread execution hijacking.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
Detects suspicious behavior associated with Remcos RAT, including UAC bypass techniques using ICMLuaUtil, process injection into system binaries, and persistence mechanism creation in the Windows registry.
Detects periodic screen captures being written to the AppData\Roaming\Screenshots directory with specific timestamped naming patterns (time_YYYYMMDD_ or wnd_YYYYMMDD_) often used by Remcos RAT to exfiltrate user activity.
This rule monitors for suspicious file creation and process execution indicative of the Remcos Remote Access Tool. It specifically looks for the creation of files containing 'keylogger.dat' or 'logs' in the user's AppData directory, as well as the execution of processes with 'remcos.exe' or 'remcos' in the path or command line arguments, signaling potential keylogging or remote control activity.
Detects file artifacts produced by the PostCSS typosquatting Windows RAT (abdrizak). Covers Chrome credential dump outputs (pwd.txt, chrome_logins_dump.txt), access to Chrome Login Data and Local State files by non-browser processes, and single-instance tracking files (.store, .host) written to the TEMP directory.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
Detects modification of Windows Registry Run keys that are either explicitly associated with Remcos RAT or involve suspicious process-to-path combinations (non-standard paths being written to by command-line utilities). This rule monitors for indicators of persistent execution via common startup registry keys.
Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.
Page 825 of 1168