Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,292 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential User Account Control (UAC) bypass attempts where a process hijacks registry keys associated with 'ms-settings' or 'mscfile' handlers (commonly used for auto-elevating binaries) and subsequently executes an arbitrary binary from a suspicious location like AppData or Temp.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.
Detects DNS queries for known TON blockchain related domains or rare top-level domains (shop, bond, sbs, cfd) initiated by common script interpreters or runtime processes like PowerShell, node, cmd, or wscript. This activity is often associated with the TONResolver, which may be used by malware for C2 communications, dead-drop resolution, or as a post-resolution staging mechanism.
Detects instances where a process originating from common suspicious directories (AppData Roaming, AppData Local, or Temp) modifies a Windows Run registry key, which is a common persistence technique used to ensure code execution upon user logon.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
This rule detects potential adversary activity by correlating the execution of known analysis or debugging tools (e.g., Wireshark, ProcessHacker, x64dbg) occurring within a 30-minute window of a process executing from suspicious, user-writable directories (typically AppData/Local or AppData/Roaming). This pattern is often indicative of an adversary staging tools to facilitate further analysis, reverse engineering, or credential harvesting on a compromised host.
Detects the payload stripping extended properties (xattr -c) to bypass macOS Gatekeeper, followed by immediate execution of the stripped file. This behavior is associated with the 'ClickFix' campaign.
Detects the use of 'attrib.exe' to modify file attributes to hidden and system for a file named 'Win.Kernel_Svc', which is indicative of the XWorm malware attempting to conceal its payload.
Page 975 of 1168