Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of common command interpreters (node, python, shell) or processes with 'mcp' in the command line that reference sensitive cloud-related environment variables or identity-related commands, such as AWS access keys, session tokens, or SSH authentication sockets. This indicates potential credential theft or unauthorized cloud resource access.
Detects the creation of a Windows service named 'MixedSvc' that points to the suspicious path 'C:\Program Files\Windows Media Player\Mixed Reality.exe'. This behavior is associated with DcRAT's Operation DragonReturn, where the malware attempts to establish persistence on the host by masquerading as a Windows Media Player component.
Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.
Detects execution patterns indicative of exploitation attempts against the CVE-2024-1086 Linux kernel vulnerability. The rule identifies suspicious usage of networking tools ('tc' with 'pedit'), namespace manipulation ('unshare'), AppArmor profile bypasses ('aa-exec'), and specific malicious binary names associated with proof-of-concept exploits for this vulnerability.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.
Detects the use of the 'unshare' utility to create new namespaces on Linux systems. Adversaries often use 'unshare' to perform container escapes, escalate privileges, or isolate processes from host-level monitoring. This rule specifically filters out legitimate administrative or container management processes such as systemd, containerd, and runc to reduce noise.
Detects unauthorized modification of the amsi.dll memory space using process access operations such as VirtualProtect. This behavior is a common technique used by malware and scripts to disable the Antimalware Scan Interface (AMSI) in-memory, allowing for the execution of malicious payloads without triggering security product alerts. The rule specifically monitors for sensitive process access granted to amsi.dll originating from high-risk parent processes such as PowerShell, script interpreters, and Microsoft Office applications.
Detects the creation of a Windows service named 'MixedSvc' or services with lure-themed display names (e.g., related to 'Windows Mixed Reality') executing binaries from suspicious, user-writable directories. This pattern is consistent with the DcRAT persistence mechanism observed in the Operation DragonReturn espionage campaign.
Page 956 of 1168