Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to clear Windows Event Logs using either the built-in 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' cmdlet. Attackers often clear these logs to remove evidence of intrusion activities, such as persistence mechanisms, account creation, or privilege escalation.
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) act as the parent process for scripting interpreters such as PowerShell or cmd.exe. This behavior is highly irregular for standard browsing activity and is often indicative of malicious code execution, such as a drive-by download or browser exploit triggering secondary payload execution.
Detects the loading of DLL files from user-writable or non-standard directories (e.g., AppData, Temp, ProgramData) that are often used in DLL sideloading attacks to hijack application search order. This rule identifies patterns associated with TRUSTRAP-style activity where a malicious DLL is placed in an adversary-controlled directory to be loaded by a legitimate application.
Detects the creation of sequentially numbered JPEG files within timestamped subdirectories of C:\Users\Public\Videos. This activity is consistent with the behavior of the SIGHTGRAB utility, a tool used by the threat actor UNC1549 for intelligence gathering through automated desktop screenshots.
Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.
Detects the execution of wscript.exe using VBScript features such as 'FileSystemObject' and 'Shell.Application' to perform directory enumeration. This pattern is commonly observed in malicious scripts used by threat actors, such as Kimsuky, to discover files and system information during the reconnaissance phase of an attack.
Detects suspicious command-line execution of cmd.exe involving specific patterns like 'MiniJunk' or 'MiniBrowse', or command-line activity spawned from common file types (e.g., .exe, .doc, .pdf, .zip). This rule is designed to identify potential multi-stage payload execution or malicious dropper activity associated with the UNC1549 threat actor.
This rule detects the execution of a Windows command shell (cmd.exe) spawned by Windows Explorer occurring within a 10-second window of network traffic identified as socket.io or websocket communication. This behavior often suggests a potential reverse shell or C2 connection where a command shell is invoked through or in conjunction with web-based communication channels.
Detects the abuse of the Windows built-in Certutil.exe utility for deobfuscating files or downloading remote content. This rule identifies common patterns associated with malicious activity, including the decoding of encoded files and the use of the urlcache flag to download remote files, which are techniques often used to bypass security controls and retrieve second-stage payloads.
Detects the creation of new registry values under the HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE 'Run' keys. This behavior is indicative of malware persistence mechanisms, specifically observed in the context of UNC1549 MiniJunk campaigns following initial payload execution.
Page 852 of 1168