Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
This rule detects suspicious activity indicative of virtualization or sandbox evasion. It looks for the loading of 'mpr.dll' in conjunction with specific registry keys related to VirtualBox ('HARDWARE\ACPI\DSDT\VBOX_'). Additionally, it identifies processes executing with command lines containing strings associated with Sandboxie ('sbiedll.dll'), network connection functions ('WNetAddConnection2W'), or queries for video controller information ('SELECT CurrentRefreshRate FROM Win32_VideoController'), which are often used by malware to detect analysis environments. The rule also correlates 'mpr.dll' and 'sbiedll.dll' loads within the same process.
This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.
KQL Query
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.
This rule detects attempts to query the Windows Registry for 'WindowsRuntime' and 'ActivatableClassId' using 'reg.exe', specifically looking for 'InstallService' or '/f InstallService' in the command line. This activity could be indicative of an adversary attempting to discover or interact with COM objects or services for persistence or privilege escalation.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
KQL Query from file: Phantom Stealer Donut Shellcode Injection into explorer.exe
Detects suspicious process creations (PowerShell, Cmd, Mshta, Wscript) originating from web browsers, explorer.exe (likely from the Run dialog), or rundll32.exe. This pattern is often associated with social engineering attacks like 'ClickFix' where users are tricked into pasting malicious commands.
Page 833 of 1168