nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects XWorm V6 adding update.vbs to the Run registry key in APPDATA or TEMP directories
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
Detects suspicious Windows process execution that may indicate post-exploitation activity, lateral movement, or privilege escalation. This is a generic detection rule for uncommon or high-risk commands and tools.
Detects local accounts being added to the Administrators group using net.exe, net1.exe, or cmd.exe.
Detects HTTP GET requests to Ivanti EPMM endpoints containing the 'gPath' parameter, which is indicative of exploitation attempts against CVE-2026-1281 and CVE-2026-1340.
Detects suspicious HTTP command-line connections initiated by sqlservr.exe, which may indicate misuse or post-exploitation activity.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects suspicious child processes spawned by sqlservr.exe, potentially associated with Trigona threat actor activity.
Detects Anydesk execution from Users\Public directory, which may indicate suspicious remote access usage.
Detects the execution of executables that masquerade as common collaboration tools (e.g., Teams, Zoom, Adobe) but have characteristics of the TrustConnect RAT. TrustConnect uses large (approx. 35MB) .NET Core single-file executables where the internal/original filename is a .dll, which is a mismatch from the .exe process name.
Page 60 of 70