Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of scheduled tasks with suspicious task names (e.g., masquerading as Microsoft UI components) or payloads (e.g., Python interpreters or .cat files) set to execute every minute. This behavior is associated with the persistence mechanism of the NarwhalRAT malware used by the APT37 threat group.
This rule monitors for network connections to a specific remote IP (62.171.185.97) associated with suspicious activity. It flags connections involving specific high-risk ports, the use of Wget/1.18 for user agents, or access to the '/pwned' URL path, which are common indicators of automated attack tools or post-exploitation activity.
Detects the staging and potential execution of Java deserialization payloads associated with the ysoserial CommonCollections5 (CC5) exploit, which leverages the BadAttributeValueExpException gadget chain.
Detects the DRAYN malware enumerating security software by querying the registry key associated with the Advanced Monitoring Agent. This behavior is indicative of an adversary performing discovery to identify installed security tools on a compromised system.
Sshpass Lateral Movement
YARA-L
Detects sshpass automation usage by administrative accounts
Detects the execution of BloodHound or SharpHound Active Directory enumeration tools followed by the creation of a 'bloodhound.zip' archive, which is commonly used to exfiltrate collected Active Directory mapping data.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects the execution of various reconnaissance tools and scripts identified as part of the Kimera framework, utilized by the threat actor group MexicanMafia in Operation Escaneo. This rule monitors for specific tool names (subfinder, assetfinder, gobuster, dnsx, naabu, httpx, gowitness, findomain), associated Python scripts, and specific command-line arguments indicative of aggressive scanning behavior.
Detects the abuse of SAP RFC function modules SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT to execute arbitrary OS commands. This activity, observed in the Operation Escaneo campaign, indicates potential unauthorized system command execution via SAP application components, often leveraging specific ZREDTEAM modules or scripts.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Page 884 of 1168