Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,292 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects registry queries targeting Internet Explorer security configuration keys, such as 'WarnOnHTTPSToHTTPRedirect' or those within the 'Internet Explorer\Security' path. These queries may indicate an attempt to identify or modify security settings to facilitate malicious activities like bypassing security warnings or weakening browser protection.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects the creation of temporary files in Windows Temp or SystemTemp directories that match the naming patterns used by the Windows Installer (MSI) service. These files, often starting with 'MSI' or '~DF' and ending in '.tmp' or '.TMP', are typically legitimate installer artifacts, but suspicious patterns or unexpected execution locations may indicate staging of malicious installers.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
This rule identifies emails originating from or claiming to be from the domain 'gasparinutrition.com' or the specific address 'accounting2@gasparinutrition.com' while using the display name 'Monitoring'. This is a common pattern observed in phishing or social engineering campaigns where adversaries impersonate internal or trusted organizational functions.
Detects registry queries targeting Internet Explorer security, Windows NT versions, and Internet settings, which are commonly used by LegionLoader for environment fingerprinting and sandbox evasion during the initial staging phase.
Detects the execution of msiexec.exe or batch files from the AppData Roaming directory, as well as msiexec.exe spawning cmd.exe. These behaviors are frequently associated with staging and executing malicious payloads in user-writable directories.
Detects suspicious files, modules, or batch scripts executed from or staged within AppData Roaming directories, specifically targeting known patterns such as custom utils folders, DLL sideloading impersonation (e.g., 7z.dll, normaliz.dll), and Python C2 module components.
Detects incoming email messages containing PDF attachments from 'gasparinutrition.com' that either have suspicious filenames indicating legal or contractual documents or contain external links redirecting to non-domain URLs. These indicators are consistent with credential harvesting or phishing campaigns.
Detects instances where msiexec.exe spawns suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, or other common LOLBins, often associated with LegionLoader activity. The rule looks for suspicious command-line arguments (e.g., silent install flags, AppData paths, or specific artifacts like xupdate.bat or data.dat) indicative of malicious MSI-based proxy execution.
Page 979 of 1168