Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
This rule detects instances where specific processes (CefSharp.BrowsersSubprocess or SCef.WindowsAdapter) modify the clipboard content with strings matching common cryptocurrency wallet address patterns. This behavior is indicative of clipboard hijacking, where an adversary replaces a user's copied wallet address with their own to facilitate fraudulent transactions.
Detects command-line activity or process execution related to the EternalBlue (MS17-010) exploit suite, commonly used for lateral movement and remote code execution against SMB services (ports 445/139).
Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.
Detects evidence of common Impacket tool execution (e.g., psexec, wmiexec, smbexec, ntlmrelayx), unauthorized access to sensitive SMB administrative shares (ADMIN$, IPC$), creation of suspicious services often used for remote execution, and lateral movement via NTLM network logons.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects execution of EDRChoker, a tool designed to impair EDR telemetry, when it is passed a process list text file as an argument. The rule specifically looks for command lines containing 'list.txt', an executable name (e.g., 'tool.exe'), and the string 'edr'.
Detects the execution of Sysinternals ADExplorer. The rule specifically alerts when the utility is executed with the '-snapshot' flag and targets a file with a .dat extension, which is a technique used to perform unauthorized Active Directory enumeration and offline extraction of sensitive directory data.
Page 851 of 1168