Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of the TinyRCT backdoor, which masquerades as legitimate VMware utilities and system binaries. The rule monitors for malicious activity including suspicious execution of vmtools.exe/vmwared.exe from ProgramData, unauthorized scheduled task creation, PerfWatson2.exe execution outside of legitimate Visual Studio installation paths, and chrome_setup.exe execution from non-standard directories.
This rule monitors for suspicious process execution and module loading events, specifically targeting file paths and configurations associated with potential AppDomain Manager injection or masquerading techniques (e.g., PerfWatson2.exe, VMware tools, or Chrome setup configurations). It correlates Sysmon and Security event logs to detect known malicious patterns or abnormal file behaviors.
Detects the execution of known tunneling binaries or binaries masquerading as common security and management agents (e.g., XDRAgent, vmtools, vmwared) with suspicious command-line arguments indicative of reverse tunnel establishment or C2 activity.
Detects suspicious usage of the OSQL.EXE command-line utility, often associated with database enumeration or interaction. The rule identifies instances where OSQL queries local databases for user information, exports results to file paths, or is executed from suspicious parent processes like web shells (w3wp.exe or cmd.exe).
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
This rule detects suspicious emails exhibiting patterns associated with 'authentication laundering' by identifying the combination of legitimate scheduling or redirection links (e.g., Calendly, Google Redirect) with potentially malicious indicators such as zip file links, suspicious .cfd domains, or impersonation of booking management services. It calculates a laundering score based on these features and the health of email authentication signals (SPF/DKIM).
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects the execution of 'PerfWatson2.exe' from within the user's AppData directory. This behavior is often associated with potential masquerading attempts, as legitimate instances of this file typically reside in system directories or specific application folders. The rule includes an exclusion for Microsoft Visual Studio related paths to reduce noise.
This rule detects the execution of the Windows Service Control Manager tool (sc.exe) to interact with a service containing the string 'MixedSvc' and a reference to 'Mixed Reality.exe' in the command line. This behavior may indicate an attempt to manipulate or execute suspicious services using names that masquerade as legitimate Windows Mixed Reality components.
Detects the execution of 'Mixed Reality.exe' using the 'runas' command-line utility. This pattern is often used to execute binaries with elevated privileges or alternate user contexts, which can be an indicator of potential privilege escalation or lateral movement.
Page 954 of 1168