Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Detects malicious npm package behavior where a package uses 'npm pack' and associated script files (e.g., sync-peer.cjs) to download and overwrite its own installed files. This technique is often used in software supply chain attacks to bypass static analysis of the original package tarball by fetching a second, malicious version at runtime.
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
Detects anomalous behaviors associated with the Remcos RAT watchdog, specifically the execution of host processes (svchost.exe, rmclient.exe, fsutil.exe) by non-standard parent processes, the creation of specific 'WD' or 'exepath' registry keys in HKCU\SOFTWARE used for persistence configuration, and rapid respawn patterns indicating a watchdog process restart loop.
Detects suspicious modifications to file permissions and attributes on specific artifacts (lambsys, procq, isp.sh) known to be associated with the Lambsys cryptominer campaign. The rule monitors for execution of chmod or chattr on these artifacts, or any generic chmod activity within /tmp or /var/tmp directories.
Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.
Detects the execution of mshta.exe from common initial access vectors like document viewers (WinRAR), web browsers (Outlook, Thunderbird), or the Windows Shell (explorer.exe). Additionally, detects instances where mshta.exe subsequently spawns wscript.exe or cscript.exe, which is indicative of a multi-stage script execution chain often used to execute malicious payloads.
Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
Page 958 of 1168