Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,393 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Correlates a spoofed internal email delivering an attachment that subsequently launches PowerShell on the endpoint. Specifically, it looks for emails where the sender's domain is 'yourcompany.com' but SPF authentication fails, and then links this to a device where 'powershell.exe' is executed with specific command-line arguments indicative of web requests or encoded commands.
Detects browsers loading external anomalous scripts from known malvertising domains while visiting plaintext HTTP sites (Router injection). This rule specifically looks for network connections on port 80 (HTTP) that are joined with device network events where the remote URL matches a regex for known malvertising domains (.xyz, .top, .site) and ends with '.js', indicating an injected script.
Detects a RedVDS login followed by commands modifying domain trusts or attempting Active Directory Certificate Services (AD CS) abuse within a 2-hour window. The rule specifically looks for 'Certify.exe' or 'nltest /domain_trusts' commands after a login from a predefined RedVDS IP range.
Detects the WinRAR process creating or modifying files within the Windows Startup folder. This activity is a common technique used by attackers to achieve persistence by ensuring that a malicious payload or script is executed automatically upon user logon.
Detects instances where the WinRAR process is used to create or modify files within the Windows startup directory. This behavior is highly suspicious and often indicates an adversary attempting to establish persistence by placing a malicious script or executable in a location that executes automatically upon user login.
Detects instances where common productivity applications (such as Microsoft Office suite, Outlook, or script engines like mshta/wscript) spawn PowerShell or PowerShell Core. The rule specifically looks for suspicious command line arguments often associated with malicious payloads, such as encoded commands, download instructions, or specific indicators related to Ptero-family malware.
Detects the 'lambsys' malware terminating competing cryptocurrency miner processes (such as xmrig, kinsing, or watchdog) using process termination commands (pkill, kill, killall) from a non-root shell. The detection further correlates this activity with the launch of a new miner binary from temporary directories and subsequent outbound network connections to common mining pool ports.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.
Page 909 of 1168