Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,381 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the Lambsys cryptominer malware performing SSH credential harvesting by accessing user SSH keys (known_hosts, authorized_keys, id_rsa) with unauthorized processes, staging these files in temporary or hidden directories, and subsequently initiating outbound SSH connections for lateral movement, all correlated by process group ID.
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Detects persistence mechanisms associated with the Gamaredon Group (also known as Shuckworm/ACTINIUM) involving the Ptero-family of malware. The rule identifies suspicious combinations of encoded PowerShell commands (using -EncodedCommand, IEX, or FromBase64String), registry modification to Windows Run/RunOnce keys referencing suspicious interpreters (wscript, mshta, powershell, rundll32) within user profile paths, and command-line indicators of C2 activity such as DownloadString/WebClient or specific .ru/.online domain patterns.
Detects attempts by a user or process to disable or modify Linux kernel-level mandatory access control mechanisms, specifically SELinux and AppArmor. Such actions are commonly performed by adversaries to reduce system security posture and facilitate further malicious activity by bypassing enforced containment policies.
Detects the macOS script reading a downloaded text file, decoding the Base64 contents, and piping it to execution.
Detects the attacker leveraging a stolen token to create or modify inbox rules (e.g., moving emails to RSS Subscriptions or Archive) to hide their activities. This rule specifically looks for actions like 'New-InboxRule' or 'Set-InboxRule' with parameters indicating email manipulation such as 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead'.
Page 910 of 1168