Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
Detects network activity and process behavior consistent with the use of the Tor network for command and control (C2), specifically targeting patterns associated with The Gentlemen ransomware-as-a-service (RaaS). The rule identifies direct execution of Tor processes, unauthorized connections to common Tor SOCKS proxy ports, and specific network communication with known malicious infrastructure linked to The Gentlemen Go-based backdoor.
Detects usage of the Windows Event Utility (wevtutil.exe) with the 'cl' command-line flag, which is commonly used to clear specific Windows Event logs such as Security, System, Application, or Setup. This behavior is frequently associated with attackers attempting to remove forensic artifacts and log entries after unauthorized activity.
Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.
This rule detects the creation of scheduled tasks or registry run keys that contain suspicious path indicators or specific file names often associated with persistence mechanisms. It monitors for the use of 'schtasks.exe' or 'at.exe' to create tasks referencing paths like ProgramData, Temp, AppData, or IDM\logs, as well as modifications to the 'Run' registry key with similar suspicious values.
Detects processes attempting to read or open sensitive SSH files (keys and configuration) that are not recognized as legitimate SSH-related utilities (e.g., ssh, sshd, rsync, git). This behavior is often indicative of credential harvesting or unauthorized reconnaissance of authentication artifacts.
Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' utility. This behavior is a common indicator of anti-forensics activity where attackers attempt to remove evidence of their presence or actions on a compromised host.
Detects the use of the Windows 'attrib.exe' utility to set the hidden (+h) attribute on files or directories within 'ProgramData' or 'AppData' paths. This behavior is frequently associated with the Mustang Panda threat group to conceal malicious artifacts, such as the SHARDLOADER and ZOHOMURK implants, from standard user visibility.
Detects the creation of scheduled tasks using schtasks.exe that involve paths associated with staging (ProgramData, Temp, AppData) or are spawned by suspicious processes like Solid PDF Creator or MediumInstStart. This behavior is indicative of ransomware implant staging or persistence mechanisms used by threat actors.
Page 845 of 1168