Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Detects attempts by GreenBlood ransomware or similar threats to delete Volume Shadow Copies and Windows Backup catalogs using 'wmic.exe', 'vssadmin.exe', and 'wbadmin.exe' with specific command-line arguments. This activity is typically performed to prevent system recovery and data restoration.
Detects behaviors associated with ransomware attempting to evade sandbox or virtual machine environments. This rule specifically looks for checks against the 'OOBEInProgress' and 'SystemSetupInProgress' registry values under '\Registry\Machine\System\Setup', and the presence of '_CLUSTER_NETWORK_NAME_' in process command lines. These checks are often performed by malware, such as Reynolds ransomware, to determine if it is running in an analysis environment before proceeding with malicious activities like encryption.
Detects the creation of a file named '__RestoreYourFiles__.txt' within the Microsoft Word STARTUP folder. This file name and location are commonly associated with ransomware activity, specifically the BlackByte ransomware, which drops this file as a ransom note.
Identifies the use of tscon.exe without authorization to hijack or "shadow" active RDP sessions, a key lateral movement and spying technique. The rule specifically looks for tscon.exe being executed with command-line arguments '/dest:console' or '/dest:rdp-tcp', which are indicative of attempting to connect to or shadow an existing RDP session.
Hunts for the TiFlux agent executing commands to modify Windows Defender or Firewall registry keys to lower security postures.
Correlates the creation of a local user with the immediate addition of that user to the "Remote Desktop Users" or "Administrators" group.
Detects modern phishing tradecraft where malicious JavaScript is embedded inside SVG image files. The browser evaluates the SVG, decodes a Base64 payload, and drops a secondary archive or executable directly to disk via Blob/Data URIs. This rule specifically looks for file creation events in the Downloads folder for common executable or archive file types, correlated with browser processes (Chrome, Edge, Firefox) accessing local SVG files.
Detects the initial file drop of the TiFlux RMM binaries (often disguised or renamed) executing from untrusted locations like Downloads or Temp.
Maps the TiFlux agent initiating outbound SMB (port 445) connections to other local administrative shares, indicating active lateral movement.
Page 947 of 1168