Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,376 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of malware attempting to identify virtualized execution environments by querying specific registry keys associated with hypervisors (VMware, VirtualBox, Hyper-V) combined with WMI commands used to gather hardware and system identifiers. This behavior is indicative of environment fingerprinting used by threats like TA4922 to evade detection and analysis.
This rule detects non-browser processes attempting to read sensitive files within Chromium-based browser profiles, such as 'Login Data', 'Cookies', and 'Web Data'. Such activity is highly indicative of credential theft or session token exfiltration by malicious software targeting stored browser secrets.
Detects processes executing from user-writable directories (e.g., Temp, AppData, Downloads) that create files in Temp or AppData directories, specifically excluding common browser processes. This behavior is consistent with the post-exploitation activity of remote access trojans (RATs) such as Atlas RAT or Gh0stRAT, which may log keystrokes to a local file.
Detects the creation of scheduled tasks that contain indicators related to QEMU virtualization software (e.g., binaries, disk images) or tasks created by web server processes. This behavior is often associated with adversary attempts to establish persistence, hide malicious activity within VM environments, or execute payloads following exploitation of a web application.
This rule identifies suspicious activity associated with PyInstaller-packaged executables (specifically 'BQT.exe' and 'start.exe'). It detects these processes directly, or any processes that initiate them while referencing anti-analysis markers like debugger checks ('IsDebuggerPresent'), internal PyInstaller environment variables, or specific path markers like '_MEIPASS'. This behavior is characteristic of malware attempting to evade sandbox or manual analysis.
Detects BQT.exe attempting to access sensitive browser credential stores or staging credential files.
Detects a User Account Control (UAC) bypass technique where an adversary modifies the registry keys (HKCU\Software\Classes\mscfile\shell\open\command) to intercept execution when eventvwr.exe is launched. The rule identifies the suspicious registry write followed by the subsequent execution of a child process (like BQT.exe or start.exe) originating from eventvwr.exe.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
Page 921 of 1168