Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,393 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the RoguePlanet exploit chain where an attacker-planted binary masquerading as wermgr.exe is executed by the QueueReporting scheduled task under SYSTEM integrity and spawns an interactive shell process (conhost.exe, cmd.exe, powershell.exe). Legitimate wermgr.exe instances related to error reporting do not spawn interactive console processes.
Detects anomalous execution of chrome.exe as a child process of Python interpreters or PyInstaller-compiled binaries running from non-standard, user-writable directories. This pattern is indicative of the Glove Stealer malware attempting to perform a Chrome App-Bound Encryption (ABE) bypass by injecting a decryption helper DLL into a suspended chrome.exe process to exfiltrate master keys.
Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
This rule detects high-frequency file creation events where files are named with potential UUIDs within subdirectories of the 'Temp' folder matching the 'RP_' pattern. This activity is indicative of automated staging or data manipulation by a user-mode process, filtering out activity from system-level accounts.
This rule monitors for suspicious activity involving wermgr.exe and Windows Defender quarantine directory. It detects wermgr.exe being written to or executed from non-standard temporary paths (often associated with potential junction-redirected payload execution), non-MsMpEng processes writing to the Windows Defender quarantine folder, and the creation of NTFS Alternate Data Streams (ADS) named :WDFOO within temporary directories.
Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Page 917 of 1168