Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.
Detects network connections to common IP lookup services (e.g., ip-api.com, ipify.org) initiated by processes often associated with malware, such as Remcos RAT components or hijacked system processes like iexplore.exe. This activity is frequently used by adversaries for reconnaissance or C2 heartbeats to identify the external IP address of a compromised host.
This rule detects anomalous process execution patterns associated with Remcos RAT, specifically monitoring for the spawning of 'rmclient.exe', unauthorized spawning of 'fsutil.exe', or 'svchost.exe' being launched by processes other than system-critical services. These patterns are characteristic of Remcos RAT deploying its watchdog or performing process injection.
Detects Microsoft Office applications (Word, Excel, PowerPoint) and WordPad spawning command-line interpreters (mshta, wscript, cscript, cmd, powershell, pwsh). This behavior is often associated with macro-based malware or malicious document attachments attempting to execute scripts or shell commands to facilitate further infection stages.
This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.
Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.
Detects the creation of a 'keylogger.dat' file in common writable directories (AppData, Temp, ProgramData) by non-standard system processes. This is a behavioral indicator commonly associated with the Remcos Remote Access Trojan (RAT), which uses low-level keyboard hooks to capture input and save the data to a local file for exfiltration.
Detects Remcos RAT watchdog activity characterized by process injection into system binaries (svchost.exe, rmclient.exe, fsutil.exe) to relaunch the main payload from non-standard directories (AppData, Temp, ProgramData), or a self-resurrection loop where the malware spawns a child process with an identical file path to maintain execution after termination.
Identifies the SimpleHelp service initiating unusually heavy outbound SMB (port 445) traffic, indicating lateral movement or ransomware propagation across the network.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Page 826 of 1168