Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,289 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.
Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.
Identifies the Python backdoor natively invoking sudo -k -S pwd to silently validate phished credentials against the OS.
Detects the creation of the WinSysCache registry run key designed to launch the RuntimeHost.exe component on startup, often associated with cryptojacking campaigns.
Hunts for the stealer explicitly utilizing xattr -c to strip the com.apple.quarantine extended attribute, bypassing Gatekeeper execution protections.
Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.
Detects the secondary PowerShell stage explicitly downloading and writing the client32.exe NetSupport Manager RAT binary to disk. This rule identifies instances where a file named 'client32.exe' is created on a device, and the process responsible for this file creation is PowerShell.
Detects PowerShell executing the Add-MpPreference cmdlet specifically excluding the targeted mining executables (RuntimeHost.exe, lolMiner.exe, gminer.exe). This activity is indicative of an attacker attempting to disable or bypass Windows Defender's real-time protection for known cryptomining executables, a common tactic in cryptojacking campaigns.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Detects the netsh utility being invoked to explicitly add firewall exclusions for the TiFlux executables to ensure uninterrupted C2.
Page 993 of 1168