nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls within a 5-minute window.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. Threat actors use this for rapid lateral movement.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to the loopback address (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern is often indicative of an attacker attempting to test network connectivity or bypass security controls while also performing cleanup or destructive actions.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Page 29 of 70