nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,826 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign leveraging compromised legitimate domains to bypass email authentication controls.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines when interacting with the database.
Detects Python loading a .pyd or .so extension from common user-controlled directories like AppData, Temp, Downloads, or project directories, rather than from a trusted package installation. This behavior is indicative of the InvisibleFerret malware.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. Threat actors use this for rapid lateral movement.
This rule detects process command lines containing strings associated with 'DarkCloud' malware, such as 'darkcloud', 'dark.cloud', 'cloud.dll', or 'shadow.exe'. This could indicate the execution or presence of the DarkCloud malware on a system.
Detects the execution of the 'squid.exe' process with command line arguments that may indicate memory manipulation or buffer overflow attempts. These arguments include terms like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'. This could be indicative of an attacker attempting to exploit vulnerabilities or perform malicious memory operations within the Squid proxy server.
Detects attempts to dump credentials using 'reg save HKLM\SAM' command or the 'impacket-secretsdump' tool. These methods are commonly used by adversaries to extract password hashes from the Security Account Manager (SAM) database or other credential stores for offline cracking or reuse.
This rule detects internal HTTP PUT requests that contain the 'MZ' header, which is indicative of an executable file. This combination suggests a possible lateral movement scenario where an attacker is transferring a tool or malware within the internal network using HTTP PUT.
Page 43 of 70