Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,328 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
Detects file access events where the powrprof.dll file is accessed within the Avast Software installation directory. This pattern may be indicative of DLL hijacking or unauthorized file interaction targeting components within the Avast security product structure.
Detects the presence of specific file extensions (.p2k, .3396bw_p2k) often associated with ransomware activity, as well as the creation of 'HowToRestoreFiles.txt' which is a common indicator of a ransom note file.
This rule detects attempts by processes located outside of standard system directories (C:\Windows, C:\Program Files) but within user or program data directories (C:\Users, C:\ProgramData, C:\AppData) to access clipboard data. This could indicate malicious activity where an unauthorized application is trying to exfiltrate sensitive information from the clipboard.
This rule detects HTTP PUT requests with specific URL parameters ('buildtxd=', 'upload_id=', 'chunk_index=', 'total_chunks=') and a 'Mozilla/5.0' user agent, directed towards known malicious domains ('bestbuydomain.com', 'premierrentalpurchase.com'). This pattern is indicative of data exfiltration, potentially by malware uploading stolen data in chunks.
Detects potential data exfiltration attempts initiated by 'explorer.exe' over common third-party services or protocols such as Telegram, Discord webhooks, FTP, or SMTP. This rule specifically looks for network connections made by 'explorer.exe' to known exfiltration channels, which is unusual behavior for the Windows Explorer process.
Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.
This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.
This rule detects suspicious network connections to known infrastructure associated with the 'Borrowed Trust' gambling kit. It identifies connections to specific IP addresses, IP ranges, compromised subdomains, URLs containing affiliate referrer codes, known redirect destinations, and a unique favicon path. The rule specifically excludes connections originating from common browser processes to focus on non-browser initiated activity, which could indicate malware or other malicious software attempting to establish C2 or exfiltrate data.
Page 951 of 1168