Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the MINIRECON implant performing reconnaissance activities, including sensitive directory listing and system information gathering. The rule monitors specific sideloaded process names such as 'pcl2bmp.exe' or 'Project Proposal.exe' as they execute discovery commands like 'dir /s', 'systeminfo', 'ipconfig', and 'whoami'.
Detects Python processes attempting to read sensitive credential files (Login Data, Cookies, logins.json, key4.db) from Chrome, Firefox, and Edge directories. This behavior is indicative of the InvisibleFerret infostealer, which targets browser-stored credentials on compromised developer workstations.
Detects Python-based processes accessing sensitive local cryptocurrency wallet files and directories, including MetaMask extension storage, Exodus wallet, and Bitcoin wallet files, which are known targets of the InvisibleFerret infostealer.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects potential abuse of Active Directory Web Services (ADWS) by identifying the execution of known tools like SharpADWS or suspicious network connections to ADWS port 9389 by non-standard processes. The rule monitors Sysmon process creation and network connection events for keywords related to Active Directory web enumeration.
Detects instances where development IDEs (VS Code or Cursor) spawn suspicious child processes such as command shells (cmd, powershell, bash) or network utilities (curl, wget). The detection logic focuses on common command line patterns associated with IDE tasks or potential malicious activity.
Detects access or modification of cloud provider credential and configuration files by common script interpreters or code editors (python, node, vscode), which may indicate credential theft or misuse by an adversary.
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects the use of built-in Windows administrative utilities (icacls, cacls, takeown, attrib) to modify file permissions or attributes. This behavior is commonly observed during the staging phase of The Gentlemen ransomware attacks to restrict user access to files or hide malicious payloads prior to encryption.
Page 846 of 1168