Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
This rule detects indicators of compromise associated with the TinyRCT malware, including the loading of a malicious AppDomainManager DLL by chrome_setup.exe, network connections to a known TinyRCT staging server, and the dropping of second-stage payloads such as PerfWatson2.exe to the local application data directory.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects the execution of the fscan network scanner binary, its use with common scanning arguments, or any network communication with the known staging IP address associated with the fscan deployment.
Detects the use of the WinRAR utility to archive sensitive directories (like backup folders, web root directories, or VMware configuration data) using common flags associated with command-line archiving. This behavior is often indicative of data staging for exfiltration.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.
This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.
Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.
Detects the execution of a process named 'packet_edit_meme' on Linux systems, which is often indicative of specific malware or unauthorized tool usage.
Page 875 of 1168