Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,356 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
Detects execution of the legitimate Windows filter manager utility 'fltMC.exe' from temporary directories combined with the loading of a 'FLTLIB.dll' file from a similarly suspicious location. This pattern is indicative of DLL side-loading, often associated with the JFMBackdoor malware (Red Lamassu).
Detects WScript.exe performing multiple registry queries against sensitive Windows Classes and file association keys. This pattern of behavioral profiling is consistent with Kimsuky's NUKESPED downloader or JSE loader identifying system configuration before payload execution.
Detects high-frequency port scanning activity from external, non-private IP addresses targeting common network services. The rule identifies different scanning profiles, including wide port sweeps and targeted multi-port scans, which are consistent with reconnaissance behaviors observed in botnet activity like the KV/JDY clusters.
This rule detects command-and-control (C2) communication patterns associated with the Kimsuky threat group (specifically NUKESPED malware). It identifies network traffic to specific Fastly CDN IP addresses or domains related to the National Health Insurance Service (nhis.or.kr) originating from known malicious or suspicious execution processes like wscript.exe, cscript.exe, powershell.exe, or zlrenu8.exe.
Detects the execution of fltMC.exe from temporary directories (%TEMP% or %TMP%). This behavior is associated with the Red Lamassu JFMBackdoor campaign, where fltMC.exe is used to facilitate DLL sideloading by staging required files (fltMC.exe, FLTLIB.dll, flt.bin, and scr.mui) in the temporary folder.
Detects instances where wscript.exe or cscript.exe (commonly used to execute JSE files) spawns powershell.exe with command-line arguments indicative of the Kimsuky NUKESPED malware loader. The detection specifically looks for the combination of hidden window, base64 decoding flags, and execution from or manipulation of paths within C:\ProgramData.
Detects the NUKESPED backdoor component 'zlrenu8.exe' interacting with the 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' registry key. This activity is consistent with malware performing environment profiling or establishing persistence by targeting registry keys used for automatic startup.
Detects suspicious service-based persistence activity associated with JFMBackdoor, specifically when fltMC.exe (a known host process) initiates child processes sc.exe or services.exe to create or start a service, using file paths located in C:\ProgramData\Microsoft\Network and specific registry key modification patterns.
Page 937 of 1168