Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,394 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.
Detects instances of the 'wusvc.exe' process (associated with the Snowlight malware) enumerating known security, analysis, and debugging tools on a compromised host. The rule monitors for the co-occurrence of this process and identified security tool processes within a short timeframe on the same device.
Detects unauthorized modifications to the Winlogon registry keys 'Shell' and 'Userinit'. These keys are commonly abused by adversaries to achieve persistence by executing malicious binaries or scripts upon user logon. The rule excludes modifications by the SYSTEM account and flags deviations from standard Windows configuration values (e.g., non-standard Shell values, or Userinit values that do not point to the expected system file).
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects the forceful termination of web browsers using taskkill.exe, a common behavior for info stealers attempting to unlock browser databases.
Detects instances where a process named wusvc.exe is executed from suspicious directories (such as Downloads, AppData, Temp, or Public folders) instead of the legitimate Windows system directories (System32 or SysWOW64). It further restricts the scope to processes spawned by common user applications like web browsers or explorer.exe, indicating potential masquerading or execution of malicious binaries disguised as the Windows Update service.
This rule detects processes other than common web browsers (e.g., chrome, firefox, msedge) initiating outbound network connections on ports 80, 443, or 8084 to specific domains commonly associated with CDN, telemetry, or cloud-based update services. This behavior might indicate unauthorized processes communicating with external infrastructure, potentially for command and control or data exfiltration, masquerading as legitimate traffic.
Detects potential Asynchronous Procedure Call (APC) injection by monitoring for processes running from user-writable directories that request broad access (PROCESS_ALL_ACCESS) to other processes, or by detecting the initiation of QueueUserAPC or NtQueueApcThread remote thread creation.
Page 900 of 1168