Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of suspected StrikeShark-related binaries (SystemSettings.exe and FScan) when they are found running from non-standard directories or masquerading as legitimate system processes. The rule specifically monitors for instances where these binaries are executed from user-writable paths like AppData or Temp, while excluding legitimate Windows paths and processes associated with Windows Update.
Detects post-exploitation activities associated with the StrikeShark framework, specifically the use of FScan and Searchall tools for internal network port scanning and domain group enumeration using built-in Windows net commands.
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.
Detects the creation of scheduled tasks or command-line execution of task scheduling utilities (schtasks.exe, at.exe) that reference known SharkLoader persistence paths, file names, or task naming conventions.
This rule monitors process creation events (Sysmon Event ID 1) to identify suspicious executables that masquerade as common software updaters (GoogleUpdateStepup, AnyConnect, AutoUpdate) or attempt to run the Windows SystemSettings.exe binary from non-standard directories. It further flags these instances when they are launched with specific command-line indicators such as cmd.exe or PDF file paths, which are common patterns for droppers or malicious execution chains.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
This rule detects WebSocket upgrade requests targeting Multi-Context Protocol (MCP) endpoints on AutoGen Studio default ports (8080/8081). It specifically flags connections originating from non-loopback addresses where the HTTP Origin header does not contain expected local indicators ('localhost', '127.0.0.1', '::1'), which may indicate unauthorized cross-origin access or remote exploitation attempts against the local development environment.
Detects the execution of SharpGPOAbuse or usage of its associated command-line arguments. This tool is frequently used by attackers to modify Group Policy Objects (GPOs) in an Active Directory environment to achieve privilege escalation or persistent access.
Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.
Page 897 of 1168