nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Smbexec Lateral Movement
YARA-L
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it.
Detects attempts to disable Windows Defender real-time protection by modifying the DisableRealtimeMonitoring registry key using the reg.exe utility.
This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.
Detects the creation or modification of shell script files within known Linux system persistence directories ('/etc/profile.d/' and '/usr/local/lib/') that contain specific naming patterns (' .sh.local' or '.cache-update.sh'). This activity often indicates an attempt to establish persistence or inject code that executes upon user logon or system initialization.
Detects the use of the native Windows tar.exe utility to silently extract ZIP archives into the AppData directory. This behavior is associated with the Potemkin Loader, which often uses this technique to stage malicious payloads after downloading them.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Detects modifications to the 'Authentication Packages' registry key that include a DLL, which can be used for persistence by adversaries. The Local Security Authority (LSA) process loads these DLLs at system startup.
This detection identifies a pattern associated with the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
Page 10 of 70