Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,376 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the specific pattern of ADNotificationManager.exe loading the vcruntime140_1.dll, which is a known indicator of DLL side-loading used in the Gold Encounter attack chain.
This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Detects the execution of QEMU virtualization software by a SYSTEM user account with command-line arguments referencing specific file indicators (e.g., custom.qcow2, vault.db). This behavior is often indicative of an adversary using virtualization to run malicious tools, bypass security controls, or interact with sensitive data in an isolated environment.
This rule monitors GitHub repository activity (git.push, git.clone, repo.contents) to identify specific activity patterns associated with known GitHub usernames, email addresses, or specific repository paths (e.g., tools/setup, .github/scripts/precheck) and commit messages. It flags potentially significant actions such as forced pushes to default branches for review.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
This rule detects the execution of QEMU binaries from non-standard locations on Windows endpoints, or the use of port-forwarding command-line flags. Adversaries, including Payouts King and BlackBasta affiliates, leverage QEMU to establish hidden virtual machines for persistent access, credential theft, and to create covert reverse SSH tunnels to bypass network security controls.
Detects unauthorized attempts to terminate security-related processes using direct syscalls (ZwTerminateProcess). The rule monitors for processes attempting to access AV/EDR security products with high-level access rights (0x0001 or 0x1fffff) while excluding authorized security processes themselves.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects the loading of unsigned or improperly signed DLLs by high-value/legitimate Windows binaries (e.g., mmc.exe, OneDrive.exe, teams.exe, rundll32.exe) from user-writable directories such as AppData, Temp, Downloads, or ProgramData. This behavior is indicative of DLL search-order hijacking or DLL side-loading, often used by adversaries to execute malicious code within the context of trusted applications.
Page 923 of 1168