Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,414 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects the use of 'mshta.exe' to execute HTML (.html, .htm) or MHTML (.mhtml, .mht) files. This behavior is often associated with bypassing Mark-of-the-Web (MotW) protections, as attackers may use container formats to deliver files that do not properly inherit MotW markings when extracted, allowing them to be opened by 'mshta.exe' without restrictive security policies.
Detects execution of a renamed Python interpreter (python.exe, ipy.exe, ipy64.exe) from suspicious locations (e.g., Temp, Downloads) or when launched by common web browsers and shell processes. This behavior is indicative of an adversary attempting to execute malicious scripts while masquerading as a legitimate process to evade detection.
Detects suspicious commands or script-based execution strings being inserted into the Windows Explorer 'TypedPaths' registry key. This registry key stores the history of paths entered into the Windows Explorer address bar, and attackers can abuse this mechanism to execute arbitrary commands by pasting malicious strings that are then interpreted or executed by the shell.
Detects high volumes of HTTP redirect responses (3xx status codes) associated with a single client IP address, which is indicative of a redirect chain often used in malicious activity such as drive-by compromise or social engineering campaigns involving fake browser updates or 'ClickFix' lures.
FileFix (mr.d0x, June 2025) tricks victims into pasting a clipboard payload into the File Explorer address bar; explorer.exe directly spawns the hidden shell command with no legitimate GUI file-open lineage.
FileFix execution via the Explorer address bar writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths, a forensic artifact distinct from the Run dialog's RunMRU key, immediately before the malicious child process spawns.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
Page 124 of 1168