Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,286 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects WMIC process creation against a remote node, which the ransomware can use as an alternative propagation method.
Detects COM hijacking of the UnexpectedShutdownReason CLSID used by the PRISMEX dropper to establish persistence. This rule specifically looks for modifications to the InProcServer32 subkey for the CLSID {68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}.
Detects sentinelmemoryscanner.exe being executed from user-writable paths (e.g., AppData, ProgramData, Temp) instead of its legitimate, protected installation directory. This behavior can indicate an attempt to abuse the legitimate SentinelOne executable for malicious purposes, such as DLL sideloading or evasion.
Identifies self-extracting archives (SFX) natively dropping the initial VBS payload into temporary paths.
Detects the batch stager iterating through all possible drive letters to locate the mounted USB/ISO drive containing the hidden payload. This rule specifically looks for 'cmd.exe' processes executing a command line that includes a 'for' loop iterating through drive letters A through G.
Detects the creation of 'lsass.dmp' files outside of standard Windows Error Reporting (WER) or CrashDumps paths. This activity can indicate an attempt to dump LSASS memory for credential access.
This rule detects the updated GammaLoad malware's User-Agent variant. This variant is characterized by replacing double colons with double semicolons in the User-Agent string and appending '/.wsntimidate/.' to it. The detection logic specifically looks for HTTP connection events where the User-Agent matches a regex pattern indicative of this GammaLoad variant.
Identifies command prompts spawning headless Microsoft Edge with user data directories redirected and forced extension loading. This behavior is often associated with malware attempting to load malicious browser extensions or exfiltrate data without a visible browser window.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects abnormal execution of Virtual Disk Service (vds.exe, vdsldr.exe) or Windows Backup Engine (wbengine.exe) processes. This activity is often abused by Makop ransomware to hinder system recovery by deleting backups or shadow copies. The rule specifically looks for these executables being initiated by processes other than svchost.exe, services.exe, or vds.exe, which are legitimate initiators.
Page 990 of 1168