Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
This rule detects the execution of 'vaultsvc.exe' or executables starting with 'WindowsVault' and ending with '.exe' from suspicious, non-standard directories such as AppData, ProgramData, or Temp. It also flags execution from any non-system path if not in System32, SysWOW64, or Program Files. A known malicious hash for 'vaultsvc.exe' is specifically identified.
Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the loading of System.Management.Automation.dll by processes that are not standard PowerShell executables (powershell.exe, pwsh.exe, powershell_ise.exe). This behavior is indicative of in-process PowerShell execution, potentially leveraging techniques like SHEETCREEP's RunspaceFactory.CreateRunspace(). The rule specifically looks for processes loading this DLL from suspicious paths like AppData or if the process is 'vaultsvc.exe', and further filters out cases where a powershell.exe child process is spawned, to reduce false positives.
This rule detects attempts by the Rokarolla trojan to disable Google Play Protect on Android devices. It monitors for Accessibility Service actions, Android Accessibility Events, or App Control Actions that target 'com.google.android.gms' and contain keywords like 'play_protect', 'PlayProtect', 'finskyEula', 'security_scan', or 'disable'. This behavior indicates the malware is trying to suppress security scans by Google Play Protect.
Detects file creation or modification events within the Windows Credential Vault folder (AppData\Local\Microsoft\Vault), excluding legitimate activity by the 'vaultsvc.exe' process. This could indicate an attempt to access, modify, or exfiltrate stored credentials.
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
Detects a multi-stage infection chain associated with the TONResolver campaign where PowerShell is used to execute a Node.js-based RAT payload from a non-standard location in AppData\Local\Nodejs. This pattern monitors for the parent-child relationship where PowerShell launches a specific node.exe instance containing JavaScript file execution flags.
Page 834 of 1168