Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,405 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of suspicious scheduled tasks associated with TrymeLocker ransomware. The rule monitors for tasks named 'RageGuard' or 'win_guard', as well as tasks registered with high privileges using non-standard file paths such as AppData, Temp, or ProgramData, triggered by system logon or startup.
Detects the creation of local backdoor accounts with the 'rage_master_' username prefix and their subsequent addition to the local Administrators group using 'net.exe' or 'net1.exe', which is a technique characteristic of the TrymeLocker malware.
Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.
Detects suspicious self-deletion patterns associated with TrymeLocker malware. This includes processes spawning cmd.exe to execute file deletion commands (cmd /c del) or the use of batch scripts to remove the originating process executable and subsequently delete themselves.
Detects keylogging behavior associated with the TrymeLocker malware. The rule monitors for processes executing from non-standard, potentially writable directories (such as Temp, AppData, or ProgramData) that load user32.dll. This activity is indicative of an attempt to install a global Windows hook (SetWindowsHookEx) to intercept keystrokes (WH_KEYBOARD_LL).
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
This rule detects EDR evasion techniques associated with the SNOWLIGHT dropper used by UNC5221. It identifies two specific behaviors: the manual loading of ntdll.dll from non-standard Windows directories, which suggests an attempt to bypass EDR hooks through manual mapping and direct syscalls, and the loading of amsi.dll by processes running from user-writable directories (e.g., Temp, Downloads), indicative of an in-memory AMSI bypass.
Detects sandbox evasion behavior where a process enumerates virtual machine-specific registry keys (e.g., VirtualBox, VMware) or attempts to access known virtualization service processes. This pattern is characteristic of malware attempting to identify if it is running in an analysis environment to alter its behavior.
Detects the SNOWLIGHT dropper (associated with UNC5221) attempting to evade analysis. The rule monitors for the loading of 'verifier.dll' by the suspicious 'wusvc.exe' process (a common disguise for this malware) as a mechanism to perform debugger checks, alongside the enumeration of various security and analysis tools (e.g., debuggers, packet sniffers, and virtualization tools).
Detects anomalous outbound TCP network connections on port 8084 originating from non-browser processes to known CDN providers (Akamai, Microsoft). This behavior is characteristic of VSHELL RAT C2 beaconing using domain blending techniques to mask communications within expected network noise.
Page 901 of 1168