Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,602 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Python or Node.js interpreter processes accessing sensitive files related to cryptocurrency wallets and browser extensions, a behavior consistent with information-stealer malware such as InvisibleFerret used in the Contagious Interview campaign.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
This rule detects the loading of specific DLL files (SolidPDFCreator.dll, ctxmui.dll) by suspicious or masquerading process names (pcl2bmp.exe, Project Proposal.exe, Memorandum of Understanding.exe) from common user-writable or temporary directories, which is often indicative of side-loading or execution of malicious components.
Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.
Detects Node.js process querying Ethereum blockchain for C2 address.
Detects simultaneous RDP connections to multiple internal hosts originating from a single compromised RedVDS gateway, indicating rapid lateral movement.
Identifies logins from known malicious VPN/Proxy exit nodes geolocated in Canada, specifically attempting to bypass geographic conditional access rules. This rule joins location data with threat intelligence indicators to detect suspicious access patterns.
This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1 -n 2' followed by 'del /F /Q servertool.exe'. This sequence suggests an attempt to delay and then forcefully delete a file named 'servertool.exe', which could be indicative of malware self-deletion or an attacker cleaning up traces.
Page 847 of 1168