Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,299 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
Detects inbound emails associated with the Latin-placeholder PDF phishing campaign. The detection triggers based on a high spam confidence level (SCL >= 5), a spam verdict, authentication failures (SPF softfail/fail and DMARC fail), and the presence of a PDF attachment.
Detects the execution chain where msiexec.exe spawns rundll32.exe, a pattern observed in LegionLoader to proxy malicious DLL execution. The rule monitors for rundll32.exe command lines referencing common user-writable or staging directories such as AppData, Temp, or ProgramData, which are often used to host malicious payloads, while excluding known legitimate DLLs.
Detects a behavioral pattern associated with LegionLoader malware, where a process running from the 'AppData\Roaming' directory loads 'user32.dll' or 'kernel32.dll'. This pattern is frequently used to dynamically resolve GUI interaction APIs (such as MessageBoxA) via GetProcAddress as an anti-analysis and obfuscation technique.
Detects the LegionLoader malware staging its Python-based C2 module named _socket.pyd within non-standard directories in the AppData\Roaming path. This behavior is indicative of a persistence or execution staging mechanism where the malware attempts to hide its components in user-writable directories while avoiding standard Python installation paths.
This rule detects email spoofing attempts where the sender's display name is set to 'Monitoring', but the sender's email address does not contain 'monitoring', specifically targeting activity associated with the 'gasparinutrition.com' domain. This behavior is indicative of an impersonation attempt, commonly used in phishing campaigns to establish trust.
This rule detects the execution of command-line scripts (specifically .bat files) located within the user's AppData\Roaming directory. It specifically flags execution attempts associated with 'xupdate.bat' or files containing 'Traiolx Custom Utils'. This activity is characteristic of malicious persistence or background utility execution often seen in various malware strains that attempt to camouflage their operation within user profile directories.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
This rule detects various behaviors associated with the LegionLoader malware, including suspicious process execution (msiexec/cmd spawning cmd/rundll32/dllhost via AppData), anti-debugging API calls (IsDebuggerPresent, SetUnhandledExceptionFilter), and specific registry modifications targeting Internet Explorer security settings used for sandbox evasion.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Page 977 of 1168