Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Azure AD / Entra ID sign-in events that utilize the OAuth 2.0 device code authentication flow. This protocol, designed for input-constrained devices, is frequently exploited by adversary-in-the-middle phishing kits (e.g., EvilTokens) to trick users into authorizing a malicious session, effectively bypassing traditional MFA by obtaining an active session token.
Detects the execution of Windows Installer (.msi) files or screensaver (.scr) files that were recently downloaded and executed via a web browser. Attackers often use these file types as lures for fake updates or software installers to execute malicious code on the victim's system.
Detects registry value modifications to the Windows Explorer RunMRU key where the data contains indicators of obfuscated PowerShell commands. This pattern is commonly associated with the 'ClickFix' social-engineering campaign, where users are prompted to copy and paste a malicious PowerShell command into the Windows Run dialog.
Detects instances where a suspected malicious loader initiates process hollowing or APC injection by launching trusted Windows binaries (e.g., LockAppHost.exe, makecab.exe, Magnify.exe) in a suspended state. The rule identifies suspicious post-injection behavior such as unexpected network connections or child process creation originating from these typically benign binaries, which is characteristic of the DeepLoad/ClickFix attack chain.
Detects ClickFix-style fileless execution patterns where PowerShell pipelines (Invoke-RestMethod/Invoke-WebRequest) directly into execution cmdlets (Invoke-Expression/IEX) to download and execute remote scripts entirely in memory. The rule monitors for common bypass flags, hidden windows, and connections to suspicious IP address patterns or non-standard ports typically associated with malicious C2 staging.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates a child process of sqlcmd.exe. This behavior is highly suspicious and often indicates a post-exploitation activity where an attacker, having established a webshell or similar foothold on a web server, is using harvested credentials to query backend SQL databases directly.
Detects instances where an IIS worker process (w3wp.exe) spawns a command shell (cmd.exe) that executes a conditional file copy operation. This pattern is characteristic of an adversary creating a webshell by copying a payload to a filename that masquerades as a legitimate web application asset, such as a CSS bundle or validation script.
This rule monitors for suspicious command-line activity involving the Fortis payment processor's webhook log files. It detects when attackers use tools like 'findstr', 'cmd', or 'dir' to navigate directories containing webhook data and specifically searches for payment card fields such as CVV, primary account numbers, and expiration dates, which is a common indicator of post-compromise data exfiltration.
Detects DLL sideloading activity associated with the 'Lorem Ipsum Loader' malware. The rule monitors for specific combinations of legitimate Windows binaries loading specific DLLs from non-system directories, a common technique to execute malicious code via trusted processes.
Detects the presence of an embedded word-to-hex lookup table within a PE file. This technique is used by the Lorem Ipsum Loader to store shellcode as plaintext English words to evade entropy-based detection and static analysis tools. The rule matches a dense sequence of lowercase words frequently found in these malicious loaders.
Page 132 of 1168