Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,362 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects malicious artifacts and behaviors associated with TA4922 (Atlas RAT, SilentRunLoader, RomulusLoader), including known malicious file hashes, DLL sideloading patterns masquerading as legitimate graphics libraries, and unauthorized execution of Python interpreters from user-writable directories.
Detects the execution of Python interpreters from non-standard or typically user-writable locations (e.g., AppData, Temp, Downloads) or when the command line includes execution of a script file. This rule excludes common development environments to reduce noise, focusing on potentially malicious usage of Python for persistence or execution of staged scripts.
Detects the loading of the 'avicap32.dll' (Video Capture API) module by processes that are not recognized as legitimate media, conferencing, or streaming applications. This behavior is often associated with remote access tools (RATs) like Atlas RAT, which may use this library to covertly capture video from a webcam.
Detects the creation of scheduled tasks using schtasks.exe where the command points to payloads residing in user-writable directories such as AppData or Temp. This behavior is indicative of TA4922 malware (e.g., Atlas RAT or RomulusLoader) establishing persistence. The rule excludes common installers and trusted publishers to reduce false positives.
This rule detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, diskshadow) to inhibit system recovery by deleting volume shadow copies or modifying boot configurations to prevent automated system repair.
Detects attempts to clear Windows event logs using the wevtutil.exe command-line utility or by triggering native Windows Event Log IDs 1102 (Security log cleared) or 104 (System log cleared). Clearing these logs is a common technique used by adversaries to hide indicators of malicious activity following an intrusion.
This rule detects potentially malicious Python script execution by monitoring for 'python.exe' or 'pythonw.exe' processes running from suspicious locations such as 'AppData' or 'Temp' directories. It also flags 'python.exe' when it initiates suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe) and alerts on 'pythonw.exe' execution when not initiated by trusted installers.
Detects execution patterns associated with Payouts King malware, characterized by specific command-line arguments, obfuscated execution flags, and execution from suspicious directories like Temp, AppData, or ProgramData. The rule uses a scoring mechanism to identify malicious behavior, including checking against known malicious SHA256 hashes.
This rule detects unauthorized read access to Chromium-based browser sensitive files (Login Data, Cookies, Web Data) by processes other than known browser executables. This behavior is indicative of credential theft or session hijacking, often observed in malware such as Atlas RAT, ValleyRAT, and SilentRunLoader.
Detects HTTP POST beaconing behavior to known infrastructure associated with Atlas RAT and ValleyRAT malware, linked to TA4922 campaigns. The rule monitors for repeated connections to specific C2 IP addresses on TCP port 886.
Page 920 of 1168