Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
This rule monitors for network connections from common developer-related processes (e.g., node, python, npm) to known blockchain RPC endpoints, followed by a subsequent network connection within 5 minutes that is not directed at those RPC endpoints or common developer infrastructure (e.g., GitHub, NPM, PyPI). This pattern is often indicative of potential malicious activity, such as a compromised development environment performing beaconing or staging data after interacting with blockchain services.
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys involving specific values ('MicrosoftUpdate', 'OneDrive') that do not originate from standard Microsoft or OneDrive installation directories. The rule correlates registry changes with process execution events to identify potentially malicious persistence mechanisms.
Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.
Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.
Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.
Detects instances where msiexec.exe loads a DLL from non-standard system directories (outside of Program Files or Windows folders) with suspicious naming conventions (e.g., containing 'scheduler', 'update', or 'onedrive'), followed by network activity to public IP ranges or registry persistence modifications. This behavior is indicative of potential DLL side-loading or proxy execution by the Windows Installer binary to achieve persistence or command and control.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
Page 858 of 1168