Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,356 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
Detects the execution of discovery commands (e.g., whoami, tasklist, net user) spawned from the OneDrive.Sync.Service.exe process, consistent with behavior from the SPECTRALVIPER XGU module.
This rule detects potential DLL sideloading activity linked to the threat group OceanLotus (APT32). It specifically monitors for the execution of 'IntelAudioService.exe' with specific arguments indicative of loading the SpectralViper implant, as well as the execution of known legitimate but abused binaries (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' command-line flag to load malicious DLLs.
Detects the execution of ConfigurationRemotingServer.exe by WindowsPackageManagerServer.exe when the parent process is not winget.exe. This pattern is indicative of unauthorized attempts to invoke the Windows Package Manager DSC (Desired State Configuration) engine directly, bypassing standard tooling and potentially indicating an attempt to leverage COM interface abuse for code execution.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects the use of 'winget.exe' to initiate a configuration operation where the provided file path does not use the expected '.yaml' or '.yml' extension. This behavior suggests an attempt to bypass security controls or masquerade malicious content (e.g., as a text or image file) that is then processed by the WinGet DSC engine, potentially leading to unauthorized PowerShell execution.
Detects potential persistence mechanism where the WinGet Desired State Configuration (DSC) process 'ConfigurationRemotingServer.exe' writes to the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key. This is a suspicious behavior indicative of abuse, as legitimate DSC operations should not typically modify user-level persistence keys in this manner.
Detects potential exploitation of unauthenticated ServiceNow Scripted REST Resources by identifying a pattern where external IP addresses first receive 4xx (authentication required) responses when querying /api/ paths, followed by 200 OK responses for the same paths, indicating a successful authentication bypass.
Detects the execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is indicative of persistent scheduled task creation being orchestrated through the abuse of WinGet Desired State Configuration (DSC) resource management capabilities.
Detects the invocation of Windows command-line utilities (such as cmd.exe or powershell.exe) by the Windows Subsystem for Linux (WSL) process wsl.exe. This behavior indicates that a Linux-side process or user is leveraging the WSL interoperability layer to execute commands directly within the Windows host environment, which can be a technique used for defense evasion or moving between Linux and Windows contexts.
Page 933 of 1168