nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,819 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects a process opening a handle to a thread with rights to set the thread's context. This is a key indicator of thread hijacking techniques, where an adversary manipulates a waiting thread in a legitimate process to execute malicious code.
Detects common JavaScript patterns used for reflective code loading and dynamic code execution. Adversaries use these techniques to obfuscate malicious code and evade static analysis by executing code from strings or other dynamic sources.
Detects reconnaissance activity associated with the exploitation of SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771, etc.). Attackers send a specific HTTP POST request to ToolPane.aspx to probe for vulnerable servers.
Detects the execution of regsvr32.exe with suspicious command-line parameters, often used by adversaries to execute malicious code (e.g., scripts, DLLs) from remote locations or local script files. This technique is a common LOLBAS method for proxy execution.
Page 70 of 70