Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,054 copies47 likes38,395 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of common security analysis, debugging, and forensic tools such as x64dbg, IDA Pro, Wireshark, and Process Hacker. These tools are often used by adversaries for reverse engineering, malware analysis, or to gain deeper insight into a compromised host environment.
Detects process creation of an executable named 'wusvc.exe' that originates from a user Downloads directory and is not digitally signed by Microsoft Corporation. This behavior is indicative of an adversary attempting to masquerade as the legitimate Windows Update service to evade detection.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
Identifies Node.js process decrypting embedded payload via custom XOR algorithm.
Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.
Detects the modification of the Windows Registry 'LegalNoticeText' key, which is used to display a message to the user upon logon. This specific rule flags the inclusion of known ransomware-related URLs or domains in the text, commonly used as a ransom note mechanism by adversaries.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects core indicators of Grixba malware, including the persistence path of GT_NET.exe in the Public Music directory, the loading of the associated malicious CoreScanner module (inf_g.dll), staging of reconnaissance output files, and the use of GT_NET.exe to perform network lateral movement via WMI/WinRM ports.
Detects the execution of PowerShell commands intended to suspend BitLocker protection on system volumes. This behavior is indicative of VILE ransomware attempting to disable volume encryption to facilitate further malicious activity or file encryption.
Detects Pay2Key ransomware's polyglot technique where a Batch script (e.g., setup.cmd) invokes PowerShell to read its own content and execute it in-memory via Invoke-Expression (IEX). This includes detection of 64-bit PowerShell invocation from 32-bit processes using Sysnative and command-line patterns indicative of self-referencing fileless execution.
Page 904 of 1168