Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,054 copies47 likes38,395 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the manual enablement of network discovery services (fdrespub, fdPHost, SSDPSRV, upnphost) and the associated Windows Firewall rules. This activity is a known tactic used by Gentlemen ransomware to facilitate lateral movement and network share enumeration by making the compromised host visible to others and allowing it to discover peers.
Detects instances where Node.js, Python, or Go processes spawn command shell interpreters (cmd.exe, powershell.exe, etc.). This behavior is often indicative of C2 command execution by malware, such as the Graphalgo RAT, which may use these languages to execute shell-level commands after initial infection or payload execution.
Detects an exploitation chain in RouterOS where an attacker triggers an SSH rekey before authentication completes, forcing the SSH server into a post-authentication state. This allows the attacker to execute arbitrary commands over an unauthenticated channel, leading to unauthorized creation, modification, or reconstruction of sensitive system and configuration files.
Detects the execution of Python 3.12 commands via 'sudo' to elevate privileges to 'root'. The rule monitors for instances where a non-root account invokes 'sudo python3.12' and subsequently spawns a process or logs activity confirming a root-level execution session within a short time window.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects the execution of known Remote Monitoring and Management (RMM) software installers or command-line arguments when invoked by PowerShell processes. This behavior is often indicative of malicious post-compromise activity where an adversary uses legitimate remote access tools to establish persistent command-and-control access.
Detects execution of mshta.exe when initiated by common office or web browser applications, or when command arguments include external network references (URLs/UNC paths) or script protocols (vbscript/javascript), which are common patterns for LOLBAS-based initial access or exploitation.
Detects evidence of the SCKit supply chain worm within GitHub Actions CI pipelines. The rule identifies attempts to poison the build process by injecting a BASH_ENV path into GITHUB_ENV, which forces the execution of a malicious script (sckit-publish-bridge.sh) during subsequent shell steps. This script is designed to exfiltrate npm publishing credentials (NODE_AUTH_TOKEN) to external infrastructure. The detection logic covers both the injection mechanism and diagnostic output indicators from the bridge script.
Detects msiexec.exe being executed with a remote HTTP(S) URL argument that includes a token-based query parameter. This pattern is characteristic of ClickFix-style social engineering attacks where a user is tricked into manually executing a command to download and run a malicious MSI file.
Page 102 of 1168