Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects suspicious file drops by DllHost.exe into staging directories (e.g., C:\Users\Public\ or C:\ProgramData\) occurring shortly after the execution of wsl.exe, where the DllHost process itself exhibits no network activity in the host telemetry. This behavior is indicative of an attacker leveraging the Windows Subsystem for Linux (WSL2) to download payloads or tools that bypass standard Windows network monitoring, leaving behind an artifact dropped by a COM surrogate.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects DLL side-loading activity associated with the JFMBackdoor malware. The rule identifies the execution of the legitimate Windows filter manager control utility (fltMC.exe) from suspicious locations (TEMP/tmp directories) and the creation of companion payloads (FLTLIB.dll, flt.bin, or scr.mui) in those same directories, which are characteristic of the JFMBackdoor dropper chain.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Detects anomalous registry activity associated with the JFMBackdoor, specifically when the legitimate Windows utility fltMC.exe is used for registry modification or enumeration. This rule looks for high-frequency registry operations performed by fltMC.exe, particularly targeting common persistence locations or other registry paths, indicating potential malicious use following DLL side-loading.
Detects the NUKESPED (zlrenu8.exe) implant performing post-compromise reconnaissance. This rule monitors for registry enumeration and modification, as well as the spawning of common system discovery processes (e.g., net.exe, tasklist.exe, systeminfo.exe) and the querying of specific registry keys related to OS version and computer identification.
Detects malicious dropper behavior involving batch files spawning hidden PowerShell processes to download components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) to temporary directories. The rule further tracks the execution of the dropped fltMC.exe and the creation of the associated DLL/binary files, which is indicative of JFMBackdoor DLL side-loading.
Page 939 of 1168