Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,334 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious network connections to known infrastructure associated with the 'Borrowed Trust' gambling kit. It identifies connections to specific IP addresses, IP ranges, compromised subdomains, URLs containing affiliate referrer codes, known redirect destinations, and a unique favicon path. The rule specifically excludes connections originating from common browser processes to focus on non-browser initiated activity, which could indicate malware or other malicious software attempting to establish C2 or exfiltrate data.
This rule detects various activities related to the installation, configuration, and execution of OpenSSH on Windows systems. It looks for processes adding the OpenSSH server capability, creating the sshd service, generating SSH keys, and the execution of the sshd.exe process. It also includes a specific hash for a known malicious SSH artifact and firewall rule additions containing 'SSH'.
This rule detects instances where 'msiexec.exe' spawns 'cmd.exe' to execute a batch or command file (.bat or .cmd) located within the 'AppData\Roaming' directory. This behavior can be indicative of malicious activity, as adversaries often use msiexec.exe for proxy execution and drop malicious scripts in user-writable directories like AppData.
This rule detects various activities associated with the RustDesk remote access tool, including process execution, file staging (RustCustom.zip or rustdesk.exe by hash), firewall rule creation for RustDesk, and service installation related to RustDesk. Detection is based on process names, file names, SHA256 hashes, firewall rule names, and service names.
This rule detects instances where msiexec.exe, a legitimate Windows Installer utility, spawns discovery tools like wmic.exe or tasklist.exe. This behavior can be indicative of an adversary using msiexec.exe for proxy execution to gather system information, potentially bypassing security controls. The detection looks for wmic.exe or tasklist.exe being launched within a 2-minute window of msiexec.exe, with specific command-line arguments often used for process or system listing, and where msiexec.exe or cmd.exe is the initiating process or parent process.
Detects rapid, consecutive execution of commands or scripts to enumerate both the username and computername on a system within a 30-second window. This behavior is consistent with initial host fingerprinting often performed by adversaries, including techniques used by SHEETCREEP malware.
Detects the creation of potentially malicious archive files (.zip, .iso, .img, .cab) in the Downloads folder, initiated by web browsers (Chrome, Edge, Firefox), where the initiating process's command line indicates a local file access (file:///), suggesting a Blob-to-Disk dropper technique often associated with AI-obfuscated phishing campaigns.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service.
Detects the execution of the WinRAR archival utility ('rar.exe') using specific command-line flags associated with creating password-protected or encrypted archives. This behavior is often indicative of data staging and collection for exfiltration purposes.
Page 952 of 1168