Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,351 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
Detects instances where the Windows process DllHost.exe creates executable or script files in suspicious user-writable directories (e.g., Temp, Public, ProgramData). This behavior is often indicative of WSL2 (Windows Subsystem for Linux) interacting with the Windows host filesystem, where a Linux-based process may attempt to stage payloads on the Windows partition via the WSL2 interop mechanism.
Detects user-mode processes abnormally requesting the SeLoadDriverPrivilege token privilege, which is required to load vulnerable drivers into the kernel. This activity is often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks.
Correlates the user interacting with a browser in kiosk mode (potentially indicating a fake tech support page) and immediately downloading an executable file into the Downloads folder. This behavior is indicative of the Havoc Demon loader being delivered via social engineering tactics.
This rule detects unauthorized or suspicious processes accessing sensitive files within the Linux /proc filesystem or application-specific directories (such as graph_api.py, main.py, or requirements.txt). By excluding standard administrative tools like systemd, rpm, dpkg, and apt, this rule highlights processes that may be performing reconnaissance, credential harvesting, or attempting to read source code in an abnormal manner.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
Correlates the execution of known data exfiltration utilities (rclone, mega-cmd, filezilla) passing configuration files or remote cloud repository targets dynamically.
Detects instances where the DllHost.exe process writes new executable files (e.g., .exe, .dll) or script files (e.g., .ps1, .vbs) to common staging locations such as C:\Users\Public, C:\Windows\Temp, or C:\ProgramData. This behavior is indicative of potential malware delivery or stage-two payload execution.
Detects instances where the DllHost process (COM Surrogate) writes executable files, scripts, or library files to common temporary or user-writable directories. This behavior is often associated with fileless or masqueraded execution techniques where attackers use legitimate system binaries to drop malicious payloads.
Detects suspicious execution of 'ssh', 'sshd', or 'uptime' binaries initiated by web server processes like 'nginx', 'fcgiwrap', or 'uptime'. This behavior often indicates exploitation of a web application to gain remote access or execute unauthorized system commands.
Page 934 of 1168