Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,405 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential Business Email Compromise (BEC) by monitoring inbound email threads for unexpected changes in the sender domain during ongoing conversations. This rule flags replies that contain payment-related keywords (e.g., IBAN, SWIFT, bank details) where the sender domain has not been observed in the previous 30 days of the thread's history.
Detects the use of PowerShell or Windows Script Host to access files within common web browser cache directories combined with indicators of Base64 decoding and pixel data manipulation. This behavior is indicative of extracting malicious payloads hidden via steganography within browser-cached image files, a technique often used in phishing campaigns to evade detection.
This rule detects the 'ClickFix' social engineering technique where a user is manipulated into manually invoking the Windows Run dialog (Win+R) and pasting a malicious command. The rule monitors for instances where explorer.exe spawns command interpreters like cmd.exe, powershell.exe, or mshta.exe with suspicious command-line patterns indicative of encoded payloads, script execution, or remote downloads.
Detects anomalous remote access patterns on a single endpoint, specifically involving AnyDesk or TeamViewer sessions originating from multiple distinct geographical locations combined with usage by multiple distinct user accounts. This pattern is consistent with DPRK IT worker fraud (Wagemole) involving shared laptop farms.
Detects the execution of conhost.exe with the --headless flag, which is commonly observed in Kimsuky LNK-based malware campaigns to execute encoded cmd.exe payloads. This pattern involves the use of certutil or echo commands to deobfuscate and execute embedded scripts, often leveraging hidden windows or process hollowing techniques for persistence and evasion.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects a suspicious sequence of events where a user's registered phone number or recovery contact method is updated, followed shortly by an MFA factor reset or new factor enrollment. This pattern is a common indicator of a SIM-swap attack, where an attacker intercepts SMS-based MFA codes after hijacking the victim's phone number.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects the creation of a Windows scheduled task where the task name contains the string 'keyroll', often associated with credential rotation or suspicious persistence mechanisms.
Detects execution of 'rnpkeys.exe' and associated DLLs ('rnp.dll' or 'tdwp.dll') located within the '\ProgramData\keyroll\' directory, which is a common persistence or staging location for malicious activity.
Page 109 of 1168