Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,382 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation of local user accounts using administrative tools such as 'net.exe', 'net1.exe', 'powershell.exe', or 'pwsh.exe'. It monitors command-line arguments indicative of account creation (e.g., 'user /add', 'New-LocalUser') and excludes legitimate parent processes commonly associated with administrative activity, such as explorer.exe or services.exe, to reduce noise.
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Detects instances where the Windows Event Viewer utility (eventvwr.exe) spawns a child process other than the Microsoft Management Console (mmc.exe). This behavior is a well-documented technique for bypassing User Account Control (UAC) because eventvwr.exe is an auto-elevating binary, which can be manipulated to execute arbitrary payloads with high-integrity privileges.
This rule detects a suspicious process execution chain where 'start.exe' or 'BQT.exe' is identified in a parent-child relationship. Specifically, it flags 'start.exe' spawning 'BQT.exe', or 'BQT.exe' subsequently invoking 'vssadmin.exe' with the 'delete shadows' command, which is a common technique used by ransomware to prevent system recovery.
Detects execution of QEMU binaries (e.g., qemu-system-x86_64.exe) that exhibit suspicious characteristics, including command-line references to disk images or databases, execution from user-writable directories (Temp, AppData, etc.), or spawning from unusual parent processes like script interpreters or remote access tools.
This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.
Detects instances where QEMU-related binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, or ADNotificationManager.exe) load modules from locations other than the standard Windows system directories or the authorized QEMU installation directory. This behavior is indicative of potential DLL side-loading or hijacking attempts, where a malicious DLL is placed in the same directory as the executable to be loaded by the application.
Detects the execution of setup or precheck scripts from specific paths ('/tools/setup' or '/.github/scripts/precheck') when spawned by common development-related shell or Node.js processes. This pattern often identifies anomalous build-time activities or execution of unauthorized configuration scripts in CI/CD or development environments.
This rule detects potentially suspicious process execution behavior on Linux systems. It triggers on the execution of specific files often used as build tools or pre-check scripts ('/tools/setup', '/.github/scripts/precheck') or processes spawned from 'node_modules' directories by common Node.js package managers ('npm', 'node', 'npx') where the spawned executable lacks standard script file extensions (e.g., .js, .sh). This is indicative of potential execution of arbitrary binaries or obfuscated scripts within a development or CI/CD environment.
Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.
Page 922 of 1168