Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,292 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of 'netsh trace' commands to start or stop network packet capturing. Adversaries can leverage this native Windows utility to perform unauthorized network traffic sniffing and data collection.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects the execution of Windows command-line utilities (icacls, cacls, attrib, takeown) used to modify file permissions or attributes, specifically when these operations are directed at sensitive system or temporary directories (e.g., ProgramData, Temp, AppData, etc.) and executed by non-system service accounts.
Detects Visual Studio Code spawning common command-line shells or interpreters (cmd.exe, powershell.exe, python, etc.) with suspicious command-line arguments, such as network download utilities (curl, wget, Invoke-WebRequest) or potentially malicious obfuscated/long arguments, which may indicate developer environment exploitation or software supply chain attacks.
Detects instances where the Python interpreter (python.exe or python3.exe) is spawned as a child process of common development environments like Visual Studio Code (code.exe) or Node.js runtime processes. This behavior may indicate an adversary using development tools as a proxy for executing malicious scripts or unauthorized code during post-exploitation activities.
Detects network connections to known blockchain and crypto-related domains (trongrid.io, aptoslabs.com) initiated by common programming and development tools (node, Code, python, python3). This pattern is often associated with the deployment of unauthorized cryptocurrency miners, blockchain interaction scripts, or malicious actors leveraging development environments.
This rule detects instances where development-related processes (such as Code.exe or node.exe) spawn web browser processes (like chrome.exe, firefox.exe, or msedge.exe). This pattern is often indicative of an adversary attempting to leverage developer environments or cross-platform applications to interact with browser-based session data, cookies, or cached credentials.
This rule detects the execution of common command-line tools (npm, node, or go) where the command arguments contain known malicious or suspicious strings associated with recent supply chain or exploitation activity (such as malicious npm packages, specific GitHub repositories, or unusual file path access).
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
Detects a Go-based backdoor associated with 'The Gentlemen' ransomware group executing commands via cmd.exe. The rule monitors for a specific pattern of WMI UUID queries alongside command-line execution of system discovery tools (whoami, net group, dir) via cmd.exe /c, which is indicative of remote command execution over a Yamux C2 channel.
Page 987 of 1168