Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,382 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the modification of Windows Run or RunOnce registry keys to execute applications from suspicious paths (e.g., Temp, AppData) or trigger PowerShell commands that contain suspicious arguments or patterns, indicating potential persistence mechanisms.
Detects the creation of scheduled tasks using schtasks.exe that execute common script interpreters (powershell.exe, wscript.exe, mshta.exe, cscript.exe) from user-writable or temporary directories (Temp, AppData, ProgramData, Users\Public). This activity often indicates an attempt to establish persistence or run malicious scripts.
This rule detects the invocation of rundll32.exe, regsvr32.exe, or mshta.exe with arguments pointing to remote resources (UNC, WebDAV, or HTTP(S) URLs). This pattern is commonly used by attackers to execute remote scriptlets (e.g., .sct, .hta, .dll) for living-off-the-land bypasses or initial staging of malicious payloads, such as the Squiblytwo or Squiblydoo techniques.
Detects suspicious PowerShell ScriptBlock logs (Event ID 4104) that attempt to bypass security features like AMSI or ETW while employing common obfuscation techniques such as Base64 encoding, reflection, or character concatenation.
Detects a low-privileged account manually triggering the 'CreateObjectTask' scheduled task, which is a known technique to force the 'Shell Create Object Handler' (dllhost.exe) to start under the SYSTEM context. This behavior is often associated with pre-exploitation steps for privilege escalation vulnerabilities, specifically those involving OBJREF marshaling targeting specific COM objects.
Detects an exploitation attempt targeting SharePoint through the EditingPageParser by injecting a Register directive. This attempt involves bypassing SafeControls through specifically crafted HTTP POST requests to ToolPane.aspx, utilizing the GetPartPreviewAndPropertiesFromMarkup function to execute malicious tag patterns.
Detects command-line activity indicative of attempts to perform a DCSync attack, a method used to simulate the replication process of a Domain Controller to extract sensitive Active Directory credentials, including password hashes, using tools like Mimikatz or DSInternals.
Detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious command-line patterns, specifically tasks pointing to potentially volatile directories (temp, appdata, programdata) or tasks executing PowerShell/CMD with common obfuscation/execution arguments such as encoded commands, hidden window styles, or base64 decoding.
This rule detects potential lateral movement activity by identifying the execution of PsExec service components or common lateral movement tools (PsExec, WMIC, CMD) interacting with Windows administrative shares (via UNC paths or specific network ports 135, 139, 445). It specifically looks for process creation events associated with these tools and network activity indicative of remote administration. Legitimate administrative tools signed by Microsoft or known management software (SolarWinds, Tanium, Ivanti, IBM BigFix) are explicitly excluded.
This rule detects persistence mechanisms involving the modification of Windows Registry 'Run' keys or the addition of executable/script files to the Windows Startup folder. It flags suspicious file types (vbs, js, hta, ps1, lnk) or the usage of common living-off-the-land binaries (wscript, cscript, powershell, mshta) when interacting with these persistence locations, while filtering out known benign processes like trustedinstaller.exe and explorer.exe.
Page 96 of 1168