Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of 'HFY.exe', which serves as the dropper for the BeepRAT malware. This dropper is typically distributed within a trojanized archive containing legitimate-looking DLLs, such as 'data.dll' (a disguised SQLite database), 'EPPlus.dll', and 'NPOI.dll'. The rule triggers when 'HFY.exe' is executed outside of standard program installation directories.
Detects the creation of image files (e.g., .bmp, .png, .jpg) in temporary or specific working directories by processes associated with BeepRAT (HFY.exe, tcc.exe, LuaJit.exe). This activity is indicative of the RAT executing screen capture commands to exfiltrate desktop imagery.
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.
This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.
This rule detects instances where OpenVPN-related processes (OpenVPNConnect.exe, openvpn.exe, or openvpnserv.exe) spawn known command-line interpreters or execute scripts containing specific markers related to OpenVPN connectivity and script execution. This behavior is indicative of potential command injection or post-exploitation activity leveraging VPN service privileges.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
This rule detects instances where ImageMagick tools (magick.exe, convert.exe, mogrify.exe, identify.exe) launch Ghostscript (gswin64c.exe) from non-standard directory locations while passing specific flags (-dQUIET, -dSAFER, -dBATCH, -dNOPAUSE) that are frequently associated with exploitation payloads (e.g., ImageTragick).
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers. Gentlemen operators rapidly deploy new BYOVD proofs-of-concept to evade and disable host defenses by dropping known vulnerable drivers to disk.
Detects unauthorized access to the LSASS process memory, a common technique for credential harvesting. The rule monitors for the execution of 'procdump.exe' or 'rundll32.exe' with parameters specifically aimed at creating a memory dump of 'lsass.exe', behaviors commonly associated with the SystemBC post-exploitation framework.
Page 842 of 1168