Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,356 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the presence of strings associated with the SPECTRALVIPER backdoor in process command lines. These strings correspond to RTTI class names and methods related to its XGU::Feature token theft and impersonation capabilities, specifically targeting functionality for lateral movement and credential manipulation.
Detects the execution of specific command primitives associated with the SpectralViper threat actor, identified by the presence of specific 'XGU::Feature::Cmd::' command strings within DeviceEvents AdditionalFields.
Detects a specific DLL sideloading technique used by the threat group OceanLotus (APT32). The rule monitors for the execution of 'IntelAudioService.exe' with suspicious command-line arguments ('/appmodel', 'StateRepository', '/Service') indicative of an attempt to load a malicious DLL, 'DtlCrashCatch.dll', to initiate the SPECTRALVIPER backdoor execution.
Detects execution of ConfigurationRemotingServer.exe as a child process of winget.exe. This activity is indicative of the DSCourier technique, which abuses the Windows Package Manager Desired State Configuration (DSC) engine to execute arbitrary PowerShell scripts embedded in configuration files, bypassing standard PowerShell invocation monitoring.
Detects instances where the 'ConfigurationRemotingServer.exe' binary is spawned by 'WindowsPackageManagerServer.exe' without 'winget.exe' being the parent process. This behavior suggests direct interaction with the WinGet DSC COM API by a non-standard client, which may be an attempt to execute arbitrary code or bypass security constraints typically enforced when using the official winget client.
Detects DLL sideloading behavior by the threat group OceanLotus (APT32), specifically targeting instances where legitimate Autodesk or HP Toolbox executables (Genuine.exe, Updater.exe, AutoCAD242.exe) are executed with the -uiDll command-line flag. This technique is used to load malicious DLLs (referred to as SPECTRALVIPER) from masqueraded, non-standard file paths such as %LOCALAPPDATA%\Autodesk or C:\Windows\appcompat, facilitating persistence and execution.
Detects evidence of the SPECTRALVIPER backdoor, specifically targeting its token theft and impersonation capabilities ('XGU::Feature'). The rule monitors for presence of specific internal RTTI class names and method strings in process command lines or activity associated with specific potentially compromised host processes such as OneDrive or Intel Audio services.
This rule detects the execution of SPECTRALVIPER malware by identifying unique RTTI class name strings ('XGU::Feature::Pivot', 'XGU::Pivot::StartLink', 'XGU::Pivot::Internal::WaitNew_RemotePipe') within command lines. These strings are associated with internal network tunneling and proxy pivoting functionality within the XGU framework.
Detects instances where the FireAnt MetaKit investment client (Metakit.exe) spawns 'setup.exe' as a child process. This pattern is indicative of a supply-chain attack involving the compromise of the FireAnt MetaKit update server, where the application is used to trigger the execution of a malicious downloader or installer.
Detects unauthenticated access attempts to the ServiceNow Scripted REST Resource endpoint '/api/now/related_list_edit/create'. This endpoint has been associated with exploitation activity targeting ServiceNow instances, particularly when accessed by the 'Guest' account or with missing session tokens.
Page 931 of 1168