Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to disable Windows Defender features, including real-time, behavior, and script scanning monitoring, as well as modifications to the 'DisableAntiSpyware' registry key, disabling system recovery via bcdedit, or execution of common scripts used to disable Windows Defender.
This rule detects instances where common web browsers (Chrome, Edge, Firefox, IE, Brave, Opera) spawn common administrative or scripting shells (PowerShell, CMD, mshta, wscript, cscript). This pattern is frequently indicative of drive-by downloads or malicious file execution triggered by social engineering, where an attacker leverages the browser process to spawn execution environments to run malicious scripts or payloads.
Detects indicators of Akira ransomware activity, including execution of the binary, dropping of ransom notes, renaming of files with .akira extension, and the use of vssadmin to delete volume shadow copies.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
Detects the modification or creation of .aspx files within the ColdFusion 'wwwroot\Images' directory. The rule flags both known webshell filenames and generic .aspx files that are not modified by the IIS worker process (w3wp.exe), which is indicative of unauthorized file manipulation or webshell deployment.
Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.
Detects the modification of the WDigest 'UseLogonCredential' registry value to 1 (enabling plaintext credential storage in memory) followed by subsequent access to the LSASS process, a common sequence in credential dumping attacks.
Detects the addition of Microsoft Defender exclusions (Path, Extension, or Process) via WMIC or PowerShell, followed by a file creation event within a suspicious directory (e.g., Temp, AppData, ProgramData) within 15 minutes. This behavior is indicative of an adversary attempting to bypass antivirus detection for malicious payloads.
Detects a user mounting a deceptive .dmg file that invokes a hidden .sh or .command script upon opening. This rule specifically looks for the 'hdiutil' process attaching a disk image and then correlates it with a process executing a hidden shell script (.sh or .command) from a mounted volume.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Page 831 of 1168