Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential Kerberoasting activity by monitoring Kerberos TGS requests (Event ID 4769) that use RC4 encryption (0x17 or 17). It identifies accounts requesting TGS tickets for a large number of unique Service Principal Names (SPNs), excluding requests for host-based services (ending in $). High volumes of such requests from a single user are indicative of an attempt to gather service tickets for offline password cracking.
Detects anomalous Kerberos TGT (AS-REQ/AS-REP) activity using Event ID 4768. The rule identifies two scenarios: (1) TGT requests that fail with specific status codes indicating issues with the account (disabled, nonexistent, or locked), and (2) TGT requests that utilize RC4 encryption with classic Golden Ticket flags (renewable/forwardable). These patterns are indicative of potential Kerberos abuse, including attempts to use compromised accounts or forged golden tickets.
Detects the creation of a remote thread in a process by another process, excluding self-injection. This behavior is a common indicator of process injection techniques used to execute code within the address space of a target process.
Detects processes attempting to obtain high-privileged handles (e.g., VM_READ/ALL_ACCESS) to the lsass.exe process. Accessing lsass.exe is a common method for credential dumping, often used by malware or red-team tools to extract sensitive credentials from memory. This rule monitors process access events and ignores known benign or administrative processes that legitimately access LSASS.
Detects instances where a user grants consent to an unverified OAuth application with high-privilege scopes (e.g., Mail.Read, Directory.Read.All), followed by an authentication event using that same application ID from a different IP address within 24 hours. This behavior is indicative of potential consent phishing or OAuth token abuse, where an adversary harvests tokens to maintain persistent, remote access to email or directory services.
This rule detects the execution of browser automation and testing tools (such as Playwright, Puppeteer, Selenium, and various browser drivers) when initiated by common, non-development-related parent processes like Microsoft Office applications, Explorer, or service hosts. This behavior is indicative of potential malicious activity, such as automated credential harvesting or unauthorized web interaction initiated by a compromised document or process.
Detects execution of PowerShell or Python scripts characterized by common patterns found in AI-generated code, including specific obfuscation techniques (base64, string manipulation), boilerplate error handling structures, verbose comments, and generic variable naming conventions. High scores indicate a higher probability of automated or obfuscated script execution.
Detects the execution of high-privilege administrative, firewall, or file-system commands by processes identified as autonomous agent runtimes (e.g., LangChain, AutoGPT) or Robotic Process Automation (RPA) tools. This rule surfaces potential unauthorized infrastructure changes or automated abuse by agents when direct change management validation is absent.
Detects autonomous AI coding-agent processes (e.g., Claude Code, Cursor, Aider) spawning shell or git processes to perform potentially destructive actions such as recursive file deletion, forced git pushes, database manipulation, or unauthorized access to sensitive credential files, indicating agentic 'excessive agency' or compromise.
This rule detects access (creation, modification, renaming, or reading) to browser-specific sensitive credential files ('Login Data' or 'Local State') located in the user data directories of Chrome, Edge, or Brave. It filters out legitimate activity by ensuring the initiating process is not the browser's own application executable, which is indicative of credential theft or dumping by unauthorized tools.
Page 183 of 1168