Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the mounting of an ISO file, particularly those with diplomatic lure filenames, followed by the execution of an executable from a newly mounted optical or removable drive. This sequence of events is indicative of an attacker using a malicious ISO to deliver and execute malware.
This rule detects attempts by the Rokarolla trojan to disable Google Play Protect on Android devices. It monitors for Accessibility Service actions, Android Accessibility Events, or App Control Actions that target 'com.google.android.gms' and contain keywords like 'play_protect', 'PlayProtect', 'finskyEula', 'security_scan', or 'disable'. This behavior indicates the malware is trying to suppress security scans by Google Play Protect.
Detects the SHEETCREEP malware's melt function, which uses a hidden 'cmd.exe' process to forcibly delete executables. This is characterized by 'cmd.exe' spawning with a specific command line pattern involving 'choice /C Y /N /D Y /T 2' for a delay, followed by 'del /f /q' to delete an .exe file. The rule also looks for file deletion events of .exe files initiated by 'cmd.exe' outside of the C:\Windows\ directory with 'del /f' or 'del /f /q' in the command line.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.
This rule detects potential command and control (C2) activity associated with the BTMOB Remote Access Trojan (RAT). It monitors for suspicious network behavior by correlating DNS requests to ip-api.com (a common geolocation service used by malware to identify the victim's location/public IP) with subsequent C2 communication to cloud services (Google Pub/Sub, Azure MQTT) or non-standard network traffic on port 3478 (often used for STUN/NAT traversal, but excluded for known browsers and communication tools) within a 30-minute window.
This rule detects the loading of suspicious DLL files (commonly associated with MinGW or image processing libraries) from user-writable directories such as AppData or Temp. Loading these libraries from these non-standard locations, particularly when not initiated by a known legitimate process, may indicate DLL side-loading or execution of masqueraded malicious binaries.
Detects instances where OpenVPN Connect executables (OpenVPNConnect.exe, openvpn.exe) spawn shell interpreters or script hosts. This pattern is often indicative of exploitation or post-exploitation activities, as legitimate VPN client operation does not typically require the execution of cmd.exe, PowerShell, or script engines.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Page 868 of 1168