Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,407 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.
This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.
Detects unauthorized modifications to common Windows persistence registry keys, including Winlogon shell/userinit hijacking, Image File Execution Options (IFEO) debugger abuse, and known malicious Run key entries.
This rule detects the use of native Windows administration tools (vssadmin, wmic, wbadmin, and bcdedit) to inhibit system recovery. Actions include deleting volume shadow copies, deleting the backup catalog, disabling Windows automatic recovery, or tampering with boot status policies. Such activities are commonly associated with ransomware operations intended to prevent system restoration and increase the impact of data destruction.
Detects the use of taskkill to forcefully terminate critical system processes, administrative utilities, or security-related software. The rule tracks command-line patterns involving common targets such as task manager, registry editor, PowerShell, security agents, or attempts to terminate wininit.exe which can trigger a system crash.
Detects inbound phishing emails that fail both DKIM and DMARC checks, contain invoice-themed subject lines, and include links pointing to known open-redirect infrastructure (holabrief.com or loopedin.io). This pattern is consistent with credential harvesting campaigns using multi-hop SaaS redirects.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects a process running at SYSTEM integrity level spawned by a parent process that is not typically associated with SYSTEM-level process creation (e.g., services.exe, lsass.exe). This behavior is characteristic of token impersonation or process spawning abuse (e.g., CreateProcessWithTokenW) used by post-exploitation frameworks like Cobalt Strike or tools involved in the StrikeShark campaign to escalate privileges.
Detects web shell deployment and subsequent execution activities associated with the StrikeShark threat. The detection covers two primary behaviors: 1) IIS worker processes (w3wp.exe or UMWorkerProcess.exe) spawning suspicious child processes (cmd.exe, powershell.exe, etc.) indicating shell command execution, and 2) IIS worker processes creating potential web shell files (.aspx, .ashx, .asmx, .svc) within sensitive web root directories, including Exchange and SharePoint paths.
Page 898 of 1168