Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,405 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential VILE ransomware activity by identifying a specific combination of Windows token manipulation APIs (e.g., AdjustTokenPrivileges, DuplicateTokenEx) paired with the usage of VILE-specific direct NT syscalls (NtCreateWaitCompletionPacket, ProcessPrng) within the same process context. This behavioral pairing serves as a high-fidelity indicator of VILE ransomware execution.
Detects Pay2Key ransomware attempting DLL search order hijacking against Avast Antivirus components. The rule monitors for two behaviors: Windows system DLLs (e.g., powrprof.dll) being loaded from the Avast installation directory, and Avast-specific component DLLs (e.g., snxhk.dll, ashBase.dll) being loaded from non-standard file paths outside the legitimate Avast software installation directory.
Detects reconnaissance and impairment attempts against security software (EDR, AV, backup) using WMI or taskkill/net commands. The rule specifically monitors for these actions when executed by processes originating from user-writable directories, a technique commonly associated with the Grixba infostealer dropped by Play Ransomware.
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Detects a suspicious self-deletion pattern associated with the Pay2Key ransomware, where an SFX dropper uses cmd.exe to execute a ping-based delay followed by fsutil to zero out the original dropper file, and subsequently performs mass deletion of remaining .exe and .bat files.
Detects the execution of the Grixba infostealer, which registers a Vectored Exception Handler (VEH) using AddVectoredExceptionHandler. This behavior is used by the malware for execution hijacking and debugger evasion to maintain persistence and prevent analysis. The rule monitors for processes identified as Grixba based on specific naming conventions or execution from suspicious paths like C:\Users\Public\Music\.
Detects Grixba infostealer execution from the C:\Users\Public\Music\ staging path, identified by the creation of RWX (PAGE_EXECUTE_READWRITE) memory regions and the registration of Vectored Exception Handlers (VEH). These behaviors are indicative of advanced process injection techniques used during the preparation phase of malware execution, often associated with the Play Ransomware group.
Detects the execution of the Grixba infostealer, associated with the Play Ransomware group, which is known to perform ntdll EDR unhooking. The rule specifically monitors the launch of the identified malicious binary (Gt_net.exe or GT_NET.exe) from the C:\Users\Public\Music\ directory, a behavior observed consistently across Grixba versions.
Detects cross-process activity (such as process injection or handle access) initiated by the Windows Update service (wusvc.exe) where the executable is not digitally signed by Microsoft Corporation. This behavior is highly suspicious as the legitimate wusvc.exe should always be signed by Microsoft, and this may indicate process masquerading or a compromised service binary.
Detects the SNOWLIGHT dropper executing or loading modules as 'wusvc.exe' (a common masquerading name) from a user Downloads directory. This behavior is indicative of a reconnaissance phase where the dropper attempts to resolve 'GetUserNameA' from 'advapi32.dll' to identify the current system user.
Page 903 of 1168