Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,335 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects instances where Microsoft Management Console (mmc.exe) spawns a hidden PowerShell process that attempts to execute commands using 'IEX' (Invoke-Expression) combined with 'DownloadString' or 'Net.WebClient'. This pattern is commonly associated with malicious activity, such as downloading and executing payloads from a remote source, often to evade detection.
This rule detects various activities associated with the Remcos Remote Access Trojan (RAT). It identifies the execution of JavaScript payloads (potentially MonoGlyphRAT) via script hosts (wscript.exe, cscript.exe), direct execution of 'remcos.exe', 'cmd.exe /c' spawned by 'remcos.exe' indicating C2 shell activity, and the creation of registry keys for Remcos persistence.
This rule detects suspicious process injection activity characterized by a sequence of API calls (VirtualAlloc, CreateRemoteThread, WriteProcessMemory) in conjunction with the loading of 'mpr.dll'. This combination of events can indicate an attempt to inject malicious code into a process, potentially for evasion or privilege escalation. The rule filters out common legitimate processes to reduce false positives.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
Identifies mstsc.exe initiating outbound TCP connections to external, non-private IP addresses over port 3389, indicating a potential connection to an attacker-controlled Terminal Server.
Detects cross-tenant service principal authentications that leverage blueprint-derived identities. This rule specifically looks for client_credentials grant types using client_assertion (JWT bearer) or client_secret targeting sensitive scopes like 'api://AzureADTokenExchange/.default' or 'AgentIdentity.CreateAsManager' from a foreign tenant service principal. This activity could indicate an attempt to establish persistence or gain unauthorized access across Azure AD tenants.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
This rule detects Vidar Stealer activity through two primary methods: a hash-based detection for a known Vidar 2.1 sample and a behavioral detection for non-standard parent processes spawning Chrome with specific command-line arguments. The behavioral detection targets Vidar's technique of using hash-resolved API calls (CreateNamedPipeA and WaitForSingleObject) to orchestrate APC injection into a suspended Chrome process for credential theft.
Page 948 of 1168