Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,247 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
A July 2026 incident used Polygon smart contracts (EtherHiding) for dynamic payload routing/C2 following a ClickFix/FileFix-style lure driven by compromised WordPress credentials.
Detects the addition of passwords or certificates to Entra ID applications or service principals by an identity that is not currently listed as an owner. This behavior is a common persistence technique used by threat actors to maintain long-term access, bypass password resets, and circumvent MFA.
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Detects unauthorized modifications or deletions of cloud logging sinks in Google Cloud Platform (GCP) or diagnostic settings in Azure, which may indicate an attacker attempting to disable audit logs to cover their tracks or evade detection.
Detects the creation or modification of federated identity credentials within Azure Active Directory (Entra ID). This technique allows external services like GitHub Actions, Kubernetes, or other identity providers to authenticate as an application without stored secrets, bypassing traditional secret-rotation and credential-scanning security controls. The rule identifies potential unauthorized persistence by highlighting external or unrecognized issuers.
Detects instances where a user grants an OAuth application sensitive, high-privilege permissions (e.g., Mail.Read, Files.ReadWrite.All, Directory.ReadWrite.All) that are commonly abused in consent phishing campaigns to maintain persistent, silent access to mail and files independent of user credentials.
Detects execution of shell commands containing obfuscated patterns (such as base64 decoding, hex character sequences, or piped commands) when spawned by core Citrix NetScaler service processes (nsppe, httpd, or nsaaad). This behavior is often indicative of exploitation attempts or post-exploitation activities on network appliances.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects anomalous web request patterns against Citrix NetScaler ADC or Gateway devices, characterized by excessively long URLs or request contexts combined with high-frequency parameter variation from a single source. This behavior is indicative of potential fuzzing or exploit attempts targeting web application vulnerabilities, specifically input validation flaws in edge infrastructure.
Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.
Page 11 of 1168