Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,362 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects unauthorized attempts by processes other than standard web browsers to access credential-related files, including browser login databases, Firefox key files, and known cryptocurrency wallet data files. These activities are indicative of credential harvesting or theft attempts by malicious software.
Detects the execution of short-lived processes (under 5 seconds) named 'start.exe' or 'BQT.exe' that contain environment variables or flags indicative of PyInstaller. This behavior is often associated with malware attempting to evade analysis or sandbox environments by executing and terminating quickly.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Detects the BQTLock ransomware loader (start.exe) spawning the primary payload (BQT.exe), which subsequently executes WMIC to perform hardware, virtualization, and sandbox environment enumeration, a technique commonly used for evasion.
Detects the execution of known legitimate QEMU binaries (qemu-system-x86_64.exe, qemu-system-i386.exe) and ADNotificationManager.exe from non-standard, user-writable, or attacker-controlled staging directories. This behavior is indicative of DLL sideloading attacks, where adversaries place malicious DLLs alongside these binaries to achieve code execution.
Identifies the execution of the elementary.pth payload natively triggering on Python interpreter startup. This rule correlates process events for Python execution with file events indicating the presence of an 'elementary.pth' file on the same device.
Detects modifications to Windows Registry Run or RunOnce keys initiated by either a QEMU-based process (qemu-system) or the Windows Registry utility (reg.exe). The rule specifically targets instances where the registry value data points to common temporary directory paths, which is characteristic of the STAC4713/GOLD ENCOUNTER intrusion activity where QEMU-based virtualization is used to facilitate persistence.
Detects rapid access to multiple sensitive developer credential files (e.g., AWS, Kubernetes, Docker, SSH keys, npm, Git, and crypto wallets) by a single process within a 5-minute window, a pattern indicative of automated credential harvesting.
This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.
Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.
Page 924 of 1168