Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of the file 'logs.dat' within the 'AppData\Roaming\DT' directory, which is a known artifact for keylogging output generated by the Remcos RAT. The detection flags this activity when performed by suspicious processes.
Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.
Detects the execution of the NetSupport Manager remote access tool (client32.exe) when spawned by web browsers or script interpreters such as PowerShell or MSHTA. This behavioral pattern is frequently associated with malicious delivery chains including ClickFix and CastleLoader, where users are social engineered into downloading or executing suspicious payloads.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.
Page 829 of 1168