Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,330 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Detects credential theft activity associated with VAPT (Vulnerability Assessment and Penetration Testing) frameworks, specifically looking for AI-generated payloads indicated by markers like 'VAPTb3gin', 'VAPTfin', and '__VAPTCMD__'. This rule also mentions 'SmartRAT' and 'Rokarolla' as key indicators, suggesting the use of specific tools or techniques often employed in such activities.
Detects potential process injection into Google Chrome processes using Asynchronous Procedure Calls (APC) or remote thread creation. This rule specifically looks for Chrome processes launched with specific command-line arguments (indicating a potentially controlled or sandboxed environment) that then have remote API calls like QueueUserApcRemoteApiCall, CreateRemoteThreadApiCall, or NtQueueApcThreadApiCall targeting them, originating from a different process. The AdditionalFields check for 'CryptUnprotectMemory', 'NtTestAlert', or 'NtQueueApcThreadEx2' further refines the detection of suspicious APC-related activities.
Detects UNG002's tactic of hiding malicious VBScripts 4+ levels deep in folders mimicking macOS metadata (__MACOSX) to evade automated scanners.
This rule detects when an application role assignment or delegated permission grant is successfully added to a service principal in Azure Active Directory, specifically looking for highly privileged permissions such as 'RoleManagement.ReadWrite.Directory', 'UserAuthenticationMethod.ReadWrite.All', 'UserAuthMethod-TAP.ReadWrite.All', or 'User.Read.All'. This could indicate an adversary attempting to gain elevated access or persistence within the Azure AD environment.
Detects PowerShell executing 'Add-AppxPackage -Register' with a UNC path, which is a core primitive of the UNCanny InstallService coercion attack. This indicates an attempt to register a loose-file AppX package from a network share.
Detects the use of 'curl.exe' with command-line arguments indicating communication through a SOCKS5 proxy on localhost:9050 to a .onion address. This pattern is often associated with Tor network usage for anonymized communication, which can be leveraged by adversaries for command and control or data exfiltration.
This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.
Detects the execution of command-line interpreters or scripting engines (cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe) as a child process of mmc.exe, specifically when mmc.exe is launched with the '-Embedding' flag. This behavior is consistent with lateral movement techniques leveraging the MMC20.Application COM object's ExecuteShellCommand method via Distributed Component Object Model (DCOM).
Detects the 'drun.exe' loader attempting to bypass Chrome's credential protection mechanisms. This is identified by 'drun.exe' invoking 'elevation_service.exe' (a Chrome component) or querying specific Chrome-related registry keys associated with App-Bound Encryption.
Page 949 of 1168