Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,286 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of PowerShell commands to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) on web application directories and configuration files, a technique often used by attackers to hide modifications made to webshells or malicious scripts.
Detects web server requests for .aspx files where the User-Agent string identifies as Windows PowerShell and includes the zh-CN locale setting. This behavior is often characteristic of automated exploitation tools or web shells (like China Chopper) interacting with compromised web servers.
Detects outbound HTTP requests to 'letsdiskuss.com' with a URI pattern of '/user/', which is characteristic of the 'STAC4924' loader utilizing a dead-drop resolver for command-and-control communication.
Detects the establishment of persistence on a Windows host by monitoring both Registry Run/RunOnce key modifications and Scheduled Task creation. The rule specifically looks for command lines or registry values that reference common Windows binary names (e.g., Microsoft Edge/Teams update helpers, LockScreenContentServer) which are frequently used by adversaries for masquerading.
Detects instances where a Microsoft IIS worker process (w3wp.exe) executes commands such as 'findstr', 'Get-Content', or 'Select-Xml' to scan configuration files (e.g., applicationHost.config, web.config) or source code files (e.g., App_Code/*.cs) for sensitive information like passwords, connection strings, or API keys. This behavior is indicative of credential harvesting by an attacker using a webshell or compromised IIS process.
Detects instances where the IIS worker process (w3wp.exe) spawns the Windows command shell (cmd.exe) to execute common reconnaissance commands such as whoami, hostname, systeminfo, and net user. This behavior is strongly indicative of post-exploitation activity following a successful web shell deployment on a web server.
Detects instances where the IIS worker process (w3wp.exe) spawns the Windows command shell (cmd.exe) to execute common reconnaissance commands such as whoami, hostname, systeminfo, and net user. This behavior is strongly indicative of post-exploitation activity following a successful web shell deployment on a web server.
This rule detects attempts by an attacker to disable or modify Windows security software and features. It monitors for three distinct behaviors: execution of 'Set-MpPreference' to modify Windows Defender settings (exclusions or real-time monitoring), execution of 'sc.exe' to stop security-related services (such as EDR or AV services), and direct modification of Windows registry keys to disable Windows Defender components.
Detects anomalous high-volume download or 'GetObject' operations from a single identity across multiple cloud storage objects and buckets within a short time window, which is indicative of bulk data exfiltration.
This rule detects suspicious NTLM network logon events (Logon Type 3) involving privileged accounts that do not have corresponding Kerberos authentication events (4768/4769) in the preceding hour. The detection specifically triggers when a single account logs into two or more distinct hosts within a 15-minute window, which is indicative of lateral movement using compromised credentials or Pass-the-Hash techniques.
Page 13 of 1168