Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,310 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the spawning of svchost.exe processes from parent processes associated with Windows Mixed Reality or NvdaHelperRemote, which may indicate malicious process injection or suspicious use of GDI screen capture APIs within a masqueraded service context.
This rule detects the use of sc.exe to create or interact with Windows services related to 'Mixed Reality' components, such as 'MixedSvc' or 'Windows Mixed Reality Service'. This activity is often associated with the installation of persistence mechanisms or service-based execution by masquerading as legitimate Windows components.
This rule detects processes that load 'amsi.dll' while concurrently performing suspicious memory or API activities often associated with AMSI bypass techniques, such as calling 'VirtualProtect' to change memory permissions or using API resolution functions like 'AmsiOpenSession', 'GetProcAddress', or 'GetModuleHandleA'. This pattern is commonly used by adversaries to disable or subvert the Antimalware Scan Interface.
Detects process start events where the command line contains the specific string 'ShitSetupOn26126k'. This appears to be a specific indicator of compromise (IOC) related to a custom script or malware installation routine.
This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.
Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.
Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.
Detects instances where common IDE-related processes (like VS Code, Amazon Q, or Node) spawn a shell to execute AWS CLI commands specifically focused on identifying the current caller identity using 'aws sts get-caller-identity' and 'curl'. This pattern often indicates attempts to verify compromised AWS credentials or discover account details from an environment.
This rule identifies endpoints making network connections to a set of known suspicious or malicious IP addresses. It aggregates the number of connections and the variety of processes initiating these connections, allowing analysts to identify potential command and control (C2) communication patterns from compromised hosts.
This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.
Page 955 of 1168