Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,408 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the SNOWLIGHT dropper performing an Antimalware Scan Interface (AMSI) bypass. The rule identifies processes that load 'amsi.dll' and subsequently perform memory manipulation (WriteProcessMemory or VirtualProtect) on the module's memory region within a 10-second window, excluding known Windows security components.
Detects unauthorized modifications to the Winlogon Shell or Userinit registry keys. The rule specifically alerts when these keys are updated to point to a binary located outside of standard Windows system directories (System32 or Program Files), which is a common persistence technique used by the TrymeLocker ransomware and other malicious software to execute code at user logon.
Detects the SNOWLIGHT dropper attempting to detect analysis or security tools by rapidly enumerating common debugging, profiling, and analysis executables (such as x64dbg, IDA Pro, Wireshark, Process Hacker, etc.). The rule triggers when a single process queries at least 3 distinct blacklisted tool names more than 5 times within a 1-minute window, a characteristic behavior used to identify and evade analysis environments.
Detects execution of 7za.exe with specific command line arguments containing 'Avast', 'data2.bin', and a specific numeric password string, which indicates potential staging or archiving of data, possibly related to malware behavior.
Detects the use of specific Windows API functions or terms commonly associated with process hollowing, code injection, or advanced process manipulation within command-line strings. The monitored functions include NtCreateWaitCompletionPacket, NtAssociateWaitCompletionPacket, RtlGetCurrentPeb, ProcessPrng, and PowerRegisterSuspendResumeNotification.
Detects the execution of PowerShell with the '-ExecutionPolicy Bypass' flag to interact with BitLocker-related cmdlets (Suspend-BitLocker or Get-BitLockerVolume). This pattern is often associated with adversary attempts to weaken or assess disk encryption protections, a technique commonly used by ransomware actors.
This rule detects modifications to the Windows Registry that enable the 'Shutdown without logon' feature, which allows a user to initiate a system shutdown without needing to log in first. This setting is often modified by attackers or during unauthorized system reconfiguration to weaken access control or facilitate disruptive activities.
Detects the use of legitimate Windows tools (wbadmin.exe and bcdedit.exe) to inhibit system recovery by deleting backup catalogs or disabling automatic Windows recovery features. This behavior is commonly associated with ransomware strains like Pay2Key to ensure that backups cannot be used to restore encrypted data.
Detects the execution of notepad.exe to open a file named 'HowToRestoreFiles.txt' from a temporary directory, which is a common indicator of a ransomware note being displayed to the victim.
Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.
Page 902 of 1168