Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,356 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of ConfigurationRemotingServer.exe, which is commonly spawned by the Windows Package Manager (winget) or WindowsPackageManagerServer.exe. This activity is part of the Windows package management infrastructure and is identified here to track the usage of these binaries which can be abused to execute commands or manipulate packages.
Detects execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is often associated with remote management or administrative tasks, but can be leveraged by adversaries to establish persistence or remote execution.
Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe to non-internal IP addresses. This process name is often associated with Windows administrative or configuration tools, and unexpected external network communication could indicate unauthorized activity, potential persistence, or command and control (C2) behavior.
Detects a suspicious process execution pattern where 'IntelAudioService.exe' is executed with specific command-line arguments, followed by network connection activity from 'OneDrive.Sync.Service.exe' on the same host within a 2-hour window. This is a common pattern for DLL side-loading to initiate command and control (C2) communication using a legitimate-looking process.
Detects DLL sideloading patterns associated with OceanLotus (APT32) SPECTRALVIPER campaigns. The rule monitors for specific process masquerading using IntelAudioService.exe or various toolbox executable variants (Genuine.exe, Updater.exe, AutoCAD242.exe) accompanied by suspicious command-line arguments or the loading of the known malicious module DtlCrashCatch.dll.
Detects cross-process memory write activity characteristic of the SPECTRALVIPER reflective injection technique. The rule identifies specific carrier processes (such as IntelAudioService.exe or OneDrive.Sync.Services.exe) that are either unsigned or spawned by a suspicious parent process, performing memory operations on other processes.
Detects instances where ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe are observed spawning schtasks.exe, powershell.exe, or pwsh.exe with command line arguments indicative of creating or registering a scheduled task. This behavior is highly irregular for these system binaries and may indicate an adversary attempting to achieve persistence by masquerading or exploiting legitimate Windows management components.
Detects the creation of new services or modification of service configurations using command-line tools (sc.exe, PowerShell) spawned by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. This activity is indicative of potential privilege escalation or persistence mechanisms being established under the context of legitimate Windows components.
This rule detects potential DLL sideloading of 'DtlCrashCatch.dll' by the 'IntelAudioService.exe' process, as well as the execution of 'IntelAudioService.exe' from suspicious user-profile directories with specific command-line arguments indicative of the SPECTRALVIPER malware execution chain.
Page 929 of 1168