nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware like SessionGate, Remus, or AnimateClipper attempting dynamic command or address resolution related to blockchain interactions.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion using `timeout /t 5` followed by `& del`.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
This rule detects attempts to stop security services (like Windows Defender) or clear event logs using 'sc stop', 'net stop', or 'wevtutil cl' commands, specifically when initiated by 'explorer.exe'. This behavior, especially when originating from explorer.exe, can indicate an adversary attempting to impair defenses or remove forensic evidence.
Detects suspicious process injection attempts where common scripting/execution binaries (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are observed creating remote threads in other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe). The detection is further refined by looking for specific keywords in the initiating process's command line that are indicative of malicious activity, such as downloading content or executing scripts. This rule aims to identify advanced persistent threats and malware leveraging process injection for defense evasion and privilege escalation.
Page 25 of 70