Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Grandoreiro banking trojan activity by identifying the loading of specific DLLs (e.g., mingwm10.dll, libwebp.dll, libffi-6.dll) from non-standard or user-writable directory paths, which is characteristic of the Grandoreiro DLL side-loading technique.
This rule detects the loading of specific DLL files (commonly associated with open-source software libraries like mingw or webp) from user-writable directories (Temp, Downloads, AppData, etc.) by specific processes. The rule further correlates these events with recent execution of potential phishing-related commands (WScript, CScript, or download-related activity) on the same host within a 1-hour window.
This rule detects potentially unauthorized processes establishing network connections over port 8883 (MQTT/MQTTS) to major cloud IoT platforms (AWS IoT, Azure IoT Hub, GCP PubSub). It flags processes that are not common web browsers and calculates a suspicious score based on data volume, execution path (e.g., Temp or AppData), and the process name not matching known legitimate IoT software.
This rule detects suspicious activity originating from an OpenVPN process by correlating the creation of temporary files (common for dropped payloads) with the subsequent execution of shell interpreters (e.g., cmd.exe, powershell.exe, bash) within a 120-second window on the same host. This pattern suggests potential exploitation or post-exploitation activities where OpenVPN is leveraged to drop and execute malicious secondary tools.
Detects suspicious WMI queries to the SecurityCenter2 namespace for security product information (AntiVirusProduct, AntiSpywareProduct, FirewallProduct) originating from common web browsers or document editors. This behavior is indicative of the Grandoreiro banking trojan attempting to identify and evade security software.
Detects the use of 'docker cp' to copy files to or from sensitive host paths, such as cron, password files, SSH keys, or system directories, which often indicates attempts to escape container isolation or establish persistence on the host.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects suspicious WMI activities including the use of WMIC, PowerShell, and script hosts to perform enumeration of system configurations, installed antivirus products, or process listings. Additionally, it identifies suspicious child processes spawned by the WMI provider (wmiprvse.exe) such as cmd, mshta, or regsvr32. The rule uses behavioral thresholds (multiple WMI calls in 30 seconds) and identifies the execution of common analyst/security tools via WMI to flag potential reconnaissance or malicious execution.
Detects activity consistent with the Grandoreiro banking trojan, including DLL sideloading, screen capturing, keystroke hooking, unauthorized network connections to known banking infrastructure, and suspicious data exfiltration bursts.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Page 871 of 1168