Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,331 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous Azure AD device registration events where device metadata is inconsistent, suggesting impersonation. The rule flags Linux hosts masquerading as Windows, non-Windows devices claiming AzureAD trust type, or the use of zeroed OS versions (0.0.0.0). High-frequency registrations (3+ devices per user in 30 minutes) correlate with known AADInternals-based attacks used by threat actor Storm-2372 to bypass Conditional Access policies.
Detects modifications to the 'Userinit' or 'Shell' values within the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' registry key, when initiated by processes running from 'AppData' or 'Temp' directories. These registry keys are commonly abused by malware to achieve persistence upon user logon.
Detects the loading of .NET assemblies (DLL, OCX, EXE) from user-writable directories such as AppData\Local\Temp or AppData\Roaming by processes that are not standard .NET development tools. This behavior is often associated with malware loaders, such as OXLOADER, that perform module stomping or use steganographic techniques to execute malicious code in memory via AppDomain.Load.
Detects a User Account Control (UAC) bypass technique where eventvwr.exe is used to spawn an elevated shell (cmd.exe or PowerShell). This occurs because eventvwr.exe is an auto-elevating binary that can be manipulated to execute arbitrary commands with high integrity without displaying a UAC prompt.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Detects the loading or access of specific DLLs (Optimax.dll or System Optimizer Ultimate.dll) by processes originating from user-writable directories (AppData or Temp), which is characteristic of the TuglaInsaatci campaign utilizing steganographic techniques to deploy Remcos RAT.
Detects the TuglaInsaatci steganographic loader technique where a randomly-named executable is dropped directly into the user's AppData\Roaming directory and subsequently launched within a short timeframe. This behavior is indicative of a self-copying persistence mechanism frequently used in campaigns like FortiBleed.
Detects code.exe launching Node to perform unauthorized background activities, specifically tied to compromised extension folders like quartz-markdown-editor or oorzc.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
Identifies the browser process saving a .zip file whose name explicitly spoofs an application update, matching the SocGholish social engineering lure.
Page 945 of 1168