Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,376 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of the Payouts King ransomware by identifying malicious process hashes, the use of a specific CRC-gated command-line parameter '-i', and the use of cmd.exe for malicious pipe redirection, which is a technique used to issue tasks without leaving direct process lineage.
This rule detects potential DLL sideloading by identifying instances where a process executing from a user-writable path (e.g., \Users, \ProgramData, \Temp) loads a DLL that resides in the same directory. This pattern is commonly associated with malicious payloads delivered via phishing archives where a legitimate binary and a malicious DLL are placed in the same folder to facilitate sideloading.
This rule identifies processes masquerading as common Windows system binaries (e.g., svchost.exe, lsass.exe) by executing from non-standard, suspicious file paths like temporary directories or user profiles instead of legitimate system directories (e.g., C:\Windows\System32).
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, wbadmin, diskshadow) and PowerShell to delete Volume Shadow Copies or disable system recovery features. These activities are commonly used by ransomware to prevent easy restoration of encrypted data.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Page 919 of 1168