Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,335 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Identifies the browser process saving a .zip file whose name explicitly spoofs an application update, matching the SocGholish social engineering lure.
Correlates JS payload execution with immediate network requests to high-reputation but compromised shadowed domains used for traffic proxying. Specifically, this rule detects network connections initiated by 'wscript.exe' to known SocGholish domain shadowing infrastructure.
Detects the use of Azure VM Run Command to execute PowerShell scripts that attempt to retrieve workload identity tokens from the Azure Instance Metadata Service (IMDS) endpoint. This activity could indicate an attacker attempting to steal credentials or escalate privileges within the Azure environment.
This rule detects the execution of a VBScript file named 'ResetRealtekAudioSettings64.vbs' by 'wscript.exe'. This specific activity has been associated with AsyncRAT, where it's used to continue the execution chain, potentially to spoof audio settings or for other malicious purposes.
Detects high-frequency reconnaissance activity on endpoints involving process enumeration and file/directory discovery. This behavior is commonly observed in the pre-ransomware phase as adversaries map out the environment, and is consistent with TTPs employed by threat actors such as BlackBasta, including the use of native administrative tools (e.g., tasklist, dir, tree, net share) and PowerShell commands for discovery.
Detects the creation of files commonly used as ransom notes (e.g., 'readme_locker' or 'readme_locker.txt') within common user directories such as the Desktop. This behavior is a strong indicator of a ransomware attack post-encryption.
Detects the execution of legitimate Windows remote assistance tools (Quick Assist, MSRA) shortly after potential external collaboration activity in Microsoft Teams. This can indicate an adversary leveraging social engineering or remote access software to establish a foothold or conduct unauthorized remote support sessions.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
Analyzes HTTP network events to detect the Komari agent executing HTTP POST requests with large data payloads, indicating data exfiltration. This rule specifically looks for HTTP POST requests combined with recent file access events for common archive file types (zip, rar, 7z, db) on the same device and by the same initiating process.
Detects the hallmark Nightspire pre-encryption routine: executing vssadmin.exe or wmic.exe to quietly delete Volume Shadow Copies, preventing host restoration.
Page 946 of 1168