Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,601 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of UAC bypass via ShellExecuteExW runas elevation from medium-integrity processes located in user-writable paths, followed by the creation of a persistent 'MixedSvc' service using sc.exe, as observed in the Operation DragonReturn campaign involving DcRAT.
Detects cross-process injection (Process Injection) from a specifically identified 'Mixed Reality' process into svchost.exe, followed by suspicious module loads (non-system32 DLLs) within that svchost.exe instance. This behavior pattern is consistent with DcRAT and XenoRAT deployment activities using masquerading or hijacked processes.
Detects anomalous use of WMI queries or the wmic.exe utility to gather system or antivirus configuration information from suspicious paths (e.g., Temp, AppData) or when executed by unexpected processes. This pattern often indicates early-stage discovery by malicious software.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Detects Chrome launch with specific crash recovery evasion flags indicative of FlutterShell.
Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.
Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
This rule monitors for processes running from a specific directory under 'AppData\Roaming\traiolx custom utils\' that load critical Windows system libraries ('user32.dll' or 'kernel32.dll'). This behavior is indicative of DLL side-loading or masquerading where an executable in a non-standard, user-writable directory attempts to load core system components, a common tactic used by malware to establish persistence or run malicious code.
This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.
Page 837 of 1168