Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,293 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.
This rule detects web browser processes (Chrome, Edge, Brave, Chromium) or potential browser extension files interacting with the 'perplexity-ai.online' domain. This is often associated with malicious browser extensions or phishing campaigns attempting to lure users to fraudulent sites.
Detects the execution of cloud CLI tools (aws, curl) or shell interpreters (bash, sh, cmd, powershell) triggered by development-related processes like Node.js, VS Code, or Amazon Q. This pattern is indicative of potential command-and-control activity or credentials theft occurring via compromised developer environments.
This rule detects the execution of specific suspicious binaries (HFY.exe or tcc.exe) or registry queries looking for common virtual machine guest additions (VMware or VirtualBox artifacts). These activities are often associated with malware attempting to detect if it is running within a virtualized or sandboxed analysis environment.
This rule monitors for the execution of suspicious processes named 'HFY.exe' or 'tcc.exe' located in specific directories, and identifies any child processes spawned by them. This is often used to track the activity of specific malicious binaries or unauthorized tools that attempt to launch further processes to carry out additional stages of an attack.
Detects the execution of specific suspicious binaries (tcc.exe or LuaJit.exe) with command-line arguments indicative of shellcode loading, followed by a network connection to known C2 infrastructure (IP 207.56.8.166 or Port 18848) from the same host within 15 minutes.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
This rule detects potential unauthorized access to AWS credentials by monitoring process creation events involving the 'get-caller-identity' command. It identifies scenarios where AWS access key environment variables are accessed or manipulated, and monitors common shell or node processes executing commands to query AWS identity information, which may indicate credential exfiltration or reconnaissance by an attacker.
Detects the presence and execution of 'HFY.exe', a trojanized telecom utility associated with BeepRAT malware. The rule flags file creation or process execution events involving this specific filename, which often indicates the reconnaissance phase where the malware generates a hardware identifier (HWID) for C2 registration.
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
Page 982 of 1168