Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,289 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious activities associated with the exploitation of AnyDesk, specifically targeting COM printer impersonation for privilege escalation and subsequent persistence. It monitors for: 1) AnyDesk or AnyDesk-runtime spawning suspicious child processes (e.g., cmd, powershell, sc), 2) unauthorized processes accessing the 'adprinterpipe' named pipe used for privilege escalation, and 3) the creation of new Windows services originating from the AnyDesk process chain.
Detects indicators of a specific malicious browser extension, including file-system artifacts (extension directory placement), registry-based persistence mechanisms, and network communication to associated command-and-control (C2) or onboarding domains. The rule specifically monitors for known malicious identifiers related to a typosquatted domain campaign impacting popular web browsers.
Detects instances where a Java-based application (specifically associated with 'floci' or API Gateway components) spawns suspicious child processes such as shell interpreters (sh, bash, powershell, cmd.exe). This pattern is often indicative of post-exploitation activity following a remote code execution (RCE) attempt against a template engine or web-facing gateway. It also identifies specific file paths related to documented 'floci' POCs and RCE payloads.
Detects ImageMagick processes (magick, convert, mogrify) spawning Ghostscript binaries (gs, gswin64c) from non-standard paths or with suspicious command-line arguments indicative of exploitation attempts, including known proof-of-concept markers.
This rule detects activities associated with c-ares TCP Use-After-Free (UAF) exploitation, specifically identifying execution of known Proof-of-Concept binaries, the creation of exploitation proof marker files, and suspicious parent-child process relationships where network-facing services or common interpreters (e.g., node, curl, python) spawn unexpected calculator or shell processes indicative of RCE payloads.
Detects potentially malicious activity originating from or related to the OpenVPN Connect client. This includes the spawning of suspicious child processes (command interpreters and utilities), the creation of a known PoC-related marker file, and modifications to the AutoConfigURL registry value, which can be used to inject PAC (Proxy Auto-Configuration) URLs.
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
This rule detects the presence or installation of a specific malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). This extension masquerades as a 'Search for perplexity ai' utility but is designed to hijack browser search queries by redirecting them to a typosquatted domain ('perplexity-ai.online') using declarativeNetRequest rules.
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
Page 1000 of 1168