Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
Detects the creation of specific files ('Mixed Reality.exe' or 'nvdaHelperRemote.dll') within the 'C:\Program Files\Windows Media Player\' directory. This activity is a known technique used by the threat actor group associated with Operation DragonReturn (Silver Fox) to stage DLL sideloading, facilitating the persistence of malware such as DcRAT or XenoRAT.
Detects the initialization sequence of the Millenium RAT, which attempts to weaken host security by adding the entire C:\ drive as an exclusion path for Windows Defender using the Add-MpPreference PowerShell cmdlet.
Detects instances of svchost.exe spawning common reconnaissance utilities like systeminfo, hostname, ipconfig, or wmic. This behavior is indicative of post-exploitation activity, specifically seen in DcRAT or XenoRAT malware where the process is injected and used for host environment profiling. The rule includes filters to exclude legitimate service-related svchost executions.
Detects reconnaissance activities performed by suspicious binaries executing from user-writable directories (AppData or Temp). The rule specifically monitors for process enumeration commands like tasklist.exe, wmic process list, and Get-Process executed by parent processes located in these paths, which is indicative of the Millenium RAT profiling its victims.
Detects reconnaissance activities performed by suspicious binaries executing from user-writable directories (AppData or Temp). The rule specifically monitors for process enumeration commands like tasklist.exe, wmic process list, and Get-Process executed by parent processes located in these paths, which is indicative of the Millenium RAT profiling its victims.
Identifies inbound emails leveraging the HR-themed "Code of Conduct" or "Employee Policy" subjects often used to trigger the AiTM campaign.
Detects phishing emails associated with the TONResolver RAT campaign that impersonate Booking.com partner support. The emails use Japanese-language lures concerning guest complaints, include 'invite.ics' calendar attachments, and contain URLs pointing to suspicious top-level domains (.cfd, .bond, .sbs, .shop) or specific 'photo-' URL patterns. The rule differentiates between malicious impersonation and legitimate booking.com domain traffic.
This rule detects the execution of DcRAT by monitoring for its unique single-instance mutex 'Global\ShitSetupOn26126k' or the execution of processes known to be associated with DcRAT, specifically 'Mixed Reality.exe' in common locations or masquerading under the provided file name.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
Page 972 of 1168