Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,292 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects LegionLoader malware performing environmental fingerprinting by querying specific Windows registry keys (Internet Settings Zones and CentralProcessor) in rapid succession. This behavior is indicative of a multi-stage check to identify sandbox or virtual machine environments before executing the final payload.
Detects potential C2 beaconing activity associated with LegionLoader by monitoring for outbound network connections to 'birdeemusic.com' domains initiated by Python or AppData/Roaming-based processes, following a precursor process launch (msiexec.exe or from AppData/Roaming) on the same host within 10 minutes.
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
This rule monitors for the creation of scheduled tasks using the Windows 'schtasks.exe' utility that contain command-line strings associated with BeepRAT malware activity. Specifically, it identifies task names or configurations used for persistence or payload execution, such as 'WindowsUpdateTempFileCleanUp', 'TCC\\config.ini.c', 'HFY.exe', and various TCC loader arguments.
This rule monitors network, proxy, and DNS traffic for connections to the domain 'perplexity-ai.online'. It identifies potentially suspicious activity by aggregating requests and distinguishing between general outbound traffic and traffic to specific endpoints, such as search queries that may indicate data exfiltration or reconnaissance.
This rule detects potential BeepRat malware activity by monitoring for specific file names associated with the threat, combined with reconnaissance behaviors. The rule identifies processes performing system information discovery, specifically machine identification (GetHWID), hardware metrics (ProcessorCount, DriveInfo), and cryptographic operations (MD5CryptoServiceProvider) which are commonly used in the initial stages of malware execution to profile target systems.
This rule detects scenarios where an unknown or suspicious executable (named HFY.exe) interacts with Windows binaries commonly used for User Account Control (UAC) bypass attacks, such as eventvwr.exe, fodhelper.exe, and consent.exe. The detection monitors process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for direct execution or parent-child relationships involving these binaries, which are often used to elevate privileges without user interaction.
Detects the use of the 'schtasks.exe' utility with command line arguments containing strings associated with suspicious activity or known malicious patterns, such as file cleanup or configuration manipulation, often used for persistence or stealthy execution.
Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.
This rule detects execution patterns associated with the BeepRAT malware family. It identifies the presence of known loaders (HFY.exe or tcc.exe) or processes exhibiting specific command-line arguments and configuration loading behavior often used by this malware. The rule also aims to identify child process activity consistent with keyboard hooking.
Page 981 of 1168