Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,293 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.
Detects potential Antimalware Scan Interface (AMSI) bypass attempts where a process loads amsi.dll followed by suspicious memory modification operations (e.g., VirtualProtect, WriteProcessMemory) targeting the AmsiOpenSession function or the amsi.dll memory space. This is a common technique used by malware like DcRAT and various loaders to neutralize endpoint security visibility.
This rule detects the installation of low-level keyboard hooks (WH_KEYBOARD_LL or WH_KEYBOARD) using API calls. It specifically monitors for processes attempting to hook keyboard input from user-writable directories (e.g., Temp, Downloads, AppData) or using unsigned/invalidly signed binaries, which is a common technique used by malware like keyloggers for credential theft.
Detects suspicious execution chains where common Windows scripting hosts (powershell.exe, cmd.exe, wscript.exe, etc.) spawn node.exe to run JavaScript files from user-writable directories (Temp, AppData, etc.). The rule flags execution patterns often associated with the TONResolver RAT, including specific PowerShell encoding or cryptography patterns and node.js scripts running from non-standard application paths.
Detects User Account Control (UAC) bypass attempts where a registry key (e.g., ms-settings, mscfile, or Folder shell open command) is created or modified in HKCU, followed within 2 minutes by the execution of an elevated child process (High or System integrity level) by known auto-elevating binaries: fodhelper.exe, computerdefaults.exe, or eventvwr.exe.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects bulk process enumeration performed by suspicious or masquerading processes using Windows system APIs (CreateToolhelp32Snapshot, NtQuerySystemInformation, ProcessSnapshot). This activity is often associated with post-compromise reconnaissance and information gathering, specifically seen in Millenium RAT variants.
Detects modifications to Windows Registry Run keys (HKCU or HKLM) by suspicious processes (cmd, powershell, wscript, cscript, node). The detection specifically looks for cases where the written value points to a binary located in user-writable or temporary directories and the binary itself is unsigned or has low trust, indicating a potential persistence mechanism being established.
This rule monitors for processes that start after a delay (between 30 and 600 seconds) following the launch of common web browsers (Chrome, Edge) or PDF readers (Acrobat, Foxit). The rule excludes common background processes associated with these applications, focusing on potential delayed execution of malicious payloads or secondary stage activity after a user has opened a document or navigated a malicious site.
This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.
Page 974 of 1168