Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of Windows file permission management utilities (icacls.exe, cacls.exe, takeown.exe) when multiple instances occur within a short window (5 minutes). This behavior is often associated with ransomware groups preparing systems for encryption by restricting user access to files.
Detects potential credential theft (e.g., InvisibleFerret/BeaverTail malware) where a node.js or python process, spawned as a child process of VS Code (Code.exe), attempts to read sensitive cloud credential files for AWS, Azure, or GCP.
Detects the clearing of multiple Windows Event Logs using the built-in 'wevtutil.exe' utility. This behavior is often associated with adversaries attempting to remove evidence of their presence or activities by clearing system, security, or application event logs.
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
Detects persistence mechanisms associated with the SHARDLOADER malware family, including the creation of suspicious scheduled tasks and modification of registry run keys. The rule monitors processes, scheduled task events, and registry value changes for specific indicators such as paths in C:\ProgramData\IDM\logs\, files named 'pcl2bmp' or 'mediuminststart', and DLL sideloading patterns involving SolidPDFCreator.
This rule detects potentially malicious child processes spawned by Node.js or npm, as well as specific file activity related to VS Code configuration or Node module directories that may indicate supply chain or development environment tampering. It flags processes like cmd.exe, powershell.exe, or python.exe being executed by code.exe or node.exe, and monitors for modifications to tasks.json or eslint-check files within sensitive directories.
Detects the execution of the Go compiler (go.exe) using command-line arguments that reference specific third-party GitHub repositories. This behavior is indicative of potential supply chain compromise, where an attacker might attempt to build or install malicious modules disguised as legitimate dependencies, or the use of automated tools that may be part of an adversary's development workflow.
This rule detects instances where Python interpreter processes (python.exe, python3.exe) access sensitive cryptocurrency wallet or keystore files. This behavior is indicative of unauthorized information collection or wallet stealer malware activity targeting local system assets.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
Page 988 of 1168