Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,299 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of common Active Directory enumeration and exploitation tools, specifically Impacket (secretsdump, getuserspns, ntlmrelayx) and BloodHound/SharpHound, by monitoring Windows Sysmon process creation events for known file names and command-line arguments.
This rule detects suspicious SAP RFC (Remote Function Call) activity, including the execution of OS commands via SXPG_CALL_SYSTEM, usage of custom ZREDTEAM command interfaces, and the presence of scripts or indicators related to SAP credential extraction (e.g., password hash access).
Detects the execution of wscript.exe with the /elevated argument, where the process was spawned by another wscript.exe instance. This behavior is indicative of potential malicious script execution attempting to bypass normal user execution constraints or using techniques to maintain elevation, often associated with living-off-the-land binaries.
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
Detects LCRYX ransomware or similar malicious scripts using wscript.exe or cscript.exe to disable Windows security features and system controls via registry modifications, such as disabling UAC, Task Manager, and Registry Tools.
Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.
This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".
Detects various methods and tools commonly used by adversaries for credential dumping, including process memory dumping of lsass.exe via procdump or comsvcs.dll, and the execution of credential dumping tools like Impacket's secretsdump, ntlmrelayx, or Mimikatz.
This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Page 965 of 1168