Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,246 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the attacker utilizing SimpleHelp's elevated privileges to create or modify Windows services to ensure persistent remote access independent of the RMM.
Correlates the SimpleHelp RMM execution with vssadmin.exe commands designed to delete shadow copies prior to ransomware deployment.
Hunts for the creation of Named Pipes matching Havoc's default profiles (\pipe\havoc_* or \pipe\demon_*) used for intra-process C2.
Correlates the completion of the OpenClaw theft routine with a network connection to Discord Webhooks to notify the threat actor. Specifically, it looks for network connections to discord.com/api/webhooks initiated by 'python.exe'.
Detects the infostealer scraping .git-credentials or .git/config specifically targeting GitHub Personal Access Tokens (PATs). The rule identifies file access events where the file name is '.git-credentials' or 'config' within a folder path containing '.git', and the initiating process is 'python.exe'.
Correlates the dropping of an rclone.conf file with the immediate execution of the Rclone utility, indicating potential data exfiltration activity.
This rule monitors web browser processes (msedge.exe, chrome.exe) for two distinct behaviors: performing network connections to known command and control (C2) or exfiltration domains, and accessing sensitive browser files such as cookies, login data, or web data files.
This rule detects indicators associated with the StegoAd malware family, specifically focusing on suspicious browser extension IDs observed in command-line arguments and network-related process activity (ProcessCreate or NetworkConnect). It monitors for known extension identifiers, StegoAd-specific C2 infrastructure domains, and payload frameworks observed in process command lines.
Detects instances where the 'consent.exe' process (typically a Windows system utility) loads a DLL named 'msimg32.dll' from a user-writable Temp directory. This behavior is indicative of DLL search order hijacking or side-loading, where an attacker plants a malicious library in a directory that a process prioritizes during the search for dependencies.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
Page 995 of 1168