Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,362 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to Windows Registry Run or RunOnce keys initiated by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. These processes are associated with Windows Package Manager (WinGet) and Desired State Configuration (DSC). Adversaries may abuse the DSC Script resource or other WinGet mechanisms to gain persistence by injecting malicious entries into these registry keys.
Detects winget.exe executing the 'configure' subcommand, which subsequently launches 'ConfigurationRemotingServer.exe'. This pattern is associated with potential abuse of Windows Desired State Configuration (DSC) to execute arbitrary code or scripts embedded within DSC configuration files, bypassing standard PowerShell execution monitoring mechanisms.
Detects modifications to Microsoft Defender configuration registry keys to disable protection features.
Identifies the EDR killer modifying the Image File Execution Options (IFEO) registry keys to silently attach a debugger (like systray.exe) to EDR components, effectively blinding them.
Correlates the EDR kill sequence with the attacker utilizing wevtutil to clear the Security and System event logs to cover their tracks. This rule detects the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System' or 'Security' event logs, joined with the creation of a '.sys' file, which could indicate a Bring Your Own Vulnerable Driver (BYOVD) attack attempting to disable EDR and clear logs.
Detects the SimpleHelp process (identified by JWrapper) attempting to open the LSASS process, which is a common technique for credential dumping. This rule specifically looks for process access events where the target is 'lsass.exe' and the initiating process is associated with SimpleHelp.
Detects the execution of IntelAudioService.exe (a common masquerade for dtlupdate.exe) which loads a malicious DtlCrashCatch.dll from an AppModel StateRepository directory, a technique historically associated with the OceanLotus (APT32) threat actor.
Detects network beaconing activity attributed to the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER C2 mechanism. The rule identifies the 'OneDrive.Sync.Services.exe' process performing HTTP GET requests to known attacker-controlled infrastructure or using specific malicious cookie headers (zd_cs_pm, euconsent-v2) for command-and-control communication.
Detects the SPECTRALVIPER downloader component characteristic of OceanLotus activity. The rule monitors for a specific HTTP POST request to a check-in URL, followed by the execution of IntelAudioService.exe with command-line arguments indicating a side-loading attack chain from the appmodel StateRepository.
Detects OceanLotus (APT32) activity utilizing DLL sideloading by executing renamed variants of Toolbox.exe (e.g., AutoCad242.exe, Genuine.exe, Updater.exe) with the '-uiDll' command-line flag to load masqueraded payloads with extensions like .json, .conf, or .log.
Page 932 of 1168