Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.
This rule detects the use of BITSAdmin and PowerShell's Start-BitsTransfer utility to download files from known malicious or suspicious GitHub repositories and specific filenames associated with campaign activity.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects behavior patterns associated with the LCRYX ransomware, specifically lateral movement via WMI (wmic.exe), network subnet scanning, file copy operations to remote SMB shares, and the dropping or execution of VBScript artifacts on removable or non-system drives.
Detects the creation of image files (JPEG, BMP, PNG) in temporary system directories by processes not associated with standard UI, browser, or imaging applications. This behavior is indicative of infostealer malware, such as StealC or Amadey, using GDI APIs like BitBlt or CreateCompatibleDC to capture desktop screenshots.
Detects modifications to the Windows Image File Execution Options (IFEO) registry key where a debugger value is configured to point to scripting engines like VBScript or Windows Script Host (wscript/cscript). This technique is commonly used for persistence or to intercept process execution by forcing the execution of scripts when legitimate applications are launched.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects execution of known reconnaissance tools and scripts associated with the Kimera framework, including subdomain and asset enumeration utilities (e.g., subfinder, nuclei, httpx) or custom Python scripts. The rule also monitors for reconnaissance-related ulimit adjustments and concurrent bursts of multiple enumeration tools, which are indicative of automated scanning activity.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Page 885 of 1168