Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,299 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.
Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
Identifies the execution of portable network scanning utilities (netscan.exe, advanced_ip_scanner.exe) that also initiate network connections to common administrative ports (135, 445, 3389). This activity is often observed post-breach to map the internal network.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
This rule monitors for modification of Windows Registry Run keys (a common persistence mechanism) by node.exe or powershell.exe, specifically targeting paths related to local Node.js installations. This behavior is indicative of an adversary attempting to establish persistence by setting an executable to run automatically upon user logon.
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
Detects the creation or access attempt of the specific named mutex 'Global\ShitSetupOn26126k'. This mutex is used by the DcRAT and Millenium RAT malware families as an anti-sandbox and anti-reinfection check; if the process detects this mutex exists, it self-terminates to avoid analysis or multiple infections.
Page 973 of 1168