Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,049 copies47 likes38,347 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the abuse of the Windows Package Manager (winget) Desired State Configuration (DSC) engine, where winget configure processes spawn configuration remoting or package manager server binaries. This behavior often indicates the execution of embedded PowerShell scripts or remote configuration files via YAML-based DSC configurations, which can be leveraged for malicious code execution.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects the creation or modification of Windows Registry Run/RunOnce keys by processes related to the WinGet DSC (Desired State Configuration) engine. This activity may indicate an adversary attempting to establish persistence by abusing legitimate configuration management utilities to execute malicious code at user logon.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the creation of Windows services or modification of service configurations triggered by WinGet DSC-related processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This pattern is often associated with the DSCourier persistence technique, where adversaries leverage the Desired State Configuration (DSC) framework to maintain a presence on a compromised host.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
Detects DLL sideloading behavior associated with OceanLotus (APT32) where legitimate, signed executables (e.g., HP or Autodesk utilities) are renamed and executed with a -uiDll command-line parameter. The rule monitors both the process creation of these renamed executables in suspicious paths and subsequent image load events of DLLs with non-standard extensions, indicating the loading of malicious payloads.
Detects instances where ConfigurationRemotingServer.exe spawns known living-off-the-land binaries (LOLBINs) or executes binaries from suspicious paths. This behavior is indicative of abuse of the WinGet DSC WindowsProcess resource block to execute arbitrary commands.
This rule detects unauthorized access or modification attempts to the Microsoft WinGet DSC (Desired State Configuration) configuration history database and associated YAML configuration files. WinGet stores execution history and DSC configuration files in specific directories; unauthorized processes interacting with these files may indicate an attempt to gain persistence, escalate privileges, or conduct reconnaissance on configured system states by inspecting or tampering with deployment manifests.
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Page 930 of 1168