Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potentially malicious modifications to registry keys associated with Internet Explorer, Windows Internet Settings, or Windows NT configuration. It specifically looks for activity involving processes running from suspicious locations (e.g., AppData) or common abuse vectors like cmd.exe and msiexec.exe that perform these registry changes repeatedly, which may indicate persistence mechanisms or defense evasion.
Detects instances of rundll32.exe being spawned by msiexec.exe or cmd.exe where the command line arguments involve loading DLLs from AppData paths, specific libraries like normaliz.dll or 7z.dll, or paths associated with LegionLoader staging activity. This behavior is indicative of malware loaders attempting to execute secondary payloads from writable user directories.
Detects the Windows Installer service (msiexec.exe) spawning the command shell (cmd.exe) to execute specific scripts or commands (xupdate.bat or Traiolx). This pattern is often associated with software installers or malicious activity attempting to run commands via child processes spawned by system-level installers.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) to execute a batch file located within the user's AppData roaming directory. This behavior is frequently associated with the deployment of malicious payloads or dropper scripts that leverage legitimate installers to maintain persistence or execute unauthorized code.
This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.
This rule detects the execution of specific utilities (e.g., 7zip components, socket modules) originating from a non-standard directory named 'AppData\Roaming\Traiolx Custom Utils'. This pathing pattern is indicative of potential malware staging or the execution of custom tooling in an attempt to masquerade as legitimate software.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
This rule detects instances of the Python interpreter (python.exe) executing from the AppData\Roaming directory, which is a common persistence location for malware. It further correlates these process events with outbound network connections to external (non-private/non-RFC1918) IP addresses, identifying potential Command and Control (C2) or data exfiltration activity.
Detects instances where the Windows Service Host process (svchost.exe) initiates more than five network connections to external (non-private/non-local) IP addresses within a short timeframe. This behavior is often characteristic of command-and-control (C2) activity or beaconing by malicious code masquerading as or injecting into system services.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.
Page 839 of 1168