Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Detects Millenium RAT attempting to bypass User Account Control (UAC) by spawning cmd.exe with the 'runas' verb via ShellExecuteExW. The rule specifically looks for cmd.exe processes running in High integrity, spawned from non-standard parent processes, while executing commands such as 'whoami'.
Detects malicious process injection behavior attributed to Operation DragonReturn, where an illegitimate executable named 'Mixed Reality.exe' located within a 'Windows Media Player' directory spawns 'svchost.exe'. This activity is indicative of a DcRAT payload attempting to inject fileless .NET code into a legitimate system process using techniques such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.
Detects the creation or modification of Windows services related to 'MixedSvc' or 'MixedRealitySvc' registry keys performed by non-standard processes. The rule specifically flags registry keys that point to suspicious directories such as AppData, Temp, ProgramData, or Windows Media Player, which is indicative of persistence mechanisms used by malware like DcRAT.
Detects attempts to terminate security product processes, either through cross-process termination or by executing taskkill.exe targeting security product image names. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection.
Detects network activity and DNS resolutions related to the tonapi.io domain initiated by unexpected processes. This pattern is indicative of the TONResolver RAT, which abuses TON smart contracts as a mechanism for command and control (C2).
Detects instances where processes not associated with standard web browsers (e.g., node.exe) attempt to create, modify, or rename browser-related sensitive files, specifically cookie databases and DPAPI-protected Local State files. Such activity is often indicative of credential and session cookie theft.
Page 835 of 1168