Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,407 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects a suspicious process chain where wscript.exe or cscript.exe (executing a VBScript file) initiates a PowerShell process with arguments typically used for downloading external content (e.g., Invoke-WebRequest, Net.WebClient), followed by subsequent actions involving remote management tools or installation packages (e.g., MSI files, ConnectWise, ScreenConnect, GoToResolve). This behavior is characteristic of initial access or secondary payload delivery via malicious scripts.
Detects instances where rundll32.exe is used to invoke shell32.dll with the SHCreateLocal function, or where a web browser process (msedge.exe, chrome.exe, or firefox.exe) is spawned by rundll32.exe to open an HTML file. This pattern is often indicative of malicious activity such as HTML smuggling or local file execution attacks where rundll32 is used as a proxy to open files via the browser.
This rule detects non-interactive sign-in events to common Microsoft services (e.g., OfficeHome, Outlook) where the User-Agent string contains 'axios/1.7.9'. This pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing kits that use the Axios library to automate token replay attacks by simulating browser sign-in requests.
Detects HTML files that employ FlipBook branding as a lure for password-gated smuggling. The detection identifies client-side JavaScript logic that uses PBKDF2 and AES-GCM to decrypt a hidden redirect URL after user interaction with a password prompt.
Detects instances where the Redis server process or the Redis AOF check utility writes directly to common SSH authorized_keys file paths. This behavior is indicative of an attacker exploiting a Redis misconfiguration or vulnerability (e.g., Redis RCE) to establish persistence by injecting an unauthorized SSH key.
Detects the presence of package.json or node_modules artifacts associated with a known typosquatting campaign targeting the 'sorted-btree' npm package. The rule identifies suspicious package names or dependencies by matching against a list of known malicious packages used in the campaign, or by detecting the co-occurrence of the malicious 'indexed-btree' package alongside the legitimate 'sorted-btree' package.
Detects the execution of PowerShell with hidden window styles and encoded commands, initiated with High Integrity (Admin) privileges. This pattern is often indicative of bypasses for User Account Control (UAC) or malicious script execution where an adversary attempts to run elevated code while minimizing user visibility.
This rule detects unauthorized attempts to perform a DCSync attack by monitoring for Active Directory Event ID 4662. It triggers when an account that is not a recognized domain controller (which typically end with a '$' sign) successfully requests replication data using the Directory Replication Service (DRS) GetNCChanges rights. This behavior is a common indicator of credential dumping via tools like Mimikatz.
Detects the spawning of suspicious child processes (powershell, cmd, node, wscript, cscript) by dependency management utilities (npm, go, terraform). Attackers often leverage malicious packages or configurations during the build or install phase to execute arbitrary code. The rule also monitors for suspicious command-line execution patterns, such as detached 'go run' operations, which may indicate malicious activity.
Detects specific JSON-RPC calls indicating C2 communication associated with the Graphalgo RAT. The rule identifies calls to the 'eth_call' method referencing specific function names like 'setCPubKey', 'serviceData', or a hardcoded Arbitrum Sepolia contract address used as a blockchain dead-drop mechanism.
Page 112 of 1168