Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,430 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects large outbound POST requests or file uploads from managed endpoints to public,
consumer-grade generative-AI chatbot domains (ChatGPT, Gemini, and equivalents). Data pasted
or uploaded into these services may be retained by the provider for logging or model
training outside company control, representing a persistent shadow-AI governance gap.
This detects the network-observable behavior (large uploads to these domains); confirming
the payload contains classification markers, source code, or PII/PCI requires DLP content
inspection integrated with the proxy.
consumer-grade generative-AI chatbot domains (ChatGPT, Gemini, and equivalents). Data pasted
or uploaded into these services may be retained by the provider for logging or model
training outside company control, representing a persistent shadow-AI governance gap.
This detects the network-observable behavior (large uploads to these domains); confirming
the payload contains classification markers, source code, or PII/PCI requires DLP content
inspection integrated with the proxy.
Detects the use of PowerShell to remove the 'Zone.Identifier' NTFS Alternate Data Stream from a file, effectively bypassing Mark-of-the-Web (MOTW) security protections. This behavior is often associated with the 'Unblock-File' cmdlet and is used by adversaries to execute downloaded malicious files without security warnings.
Detects high-frequency TCP SYN scanning activity originating from external networks targeting port 37777, commonly associated with the Dahua DVR P2P discovery service. This behavior is indicative of automated reconnaissance and scanning campaigns searching for vulnerable IoT devices.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects a successful login attempt by the user account 'p2pwn' targeting port 37777. Port 37777 is commonly associated with DVR/NVR surveillance equipment and is frequently targeted by brute-force attacks and botnets attempting to gain unauthorized access to embedded devices.
Detects network traffic attempting to exploit the Dahua CVE-2021-33044 vulnerability, which allows an unauthenticated user to bypass authentication mechanisms on affected NetKeyboard devices.
Detects potential poisoning of an AI agent's RAG knowledge base or vector store through suspicious bulk ingestion or injection of imperative instruction-style content. The rule correlates these ingestion events with subsequent anomalous tool usage patterns by the same agent session, indicating a possible prompt injection or data manipulation attack aimed at altering agent behavior.
Detects potential poisoning of an AI agent's RAG knowledge base or vector store through suspicious bulk ingestion or injection of imperative instruction-style content. The rule correlates these ingestion events with subsequent anomalous tool usage patterns by the same agent session, indicating a possible prompt injection or data manipulation attack aimed at altering agent behavior.
Detects instances where the WMI Provider Host (wmiprvse.exe) spawns suspicious child processes such as cmd.exe, powershell.exe, or rundll32.exe, which are correlated with inbound network connections on ports 135 (RPC/DCOM) or 445 (SMB). This behavior is characteristic of lateral movement techniques used by tools like Impacket's wmiexec.
Detects the creation of scheduled tasks using schtasks.exe that involve suspicious arguments (such as encoded commands, execution from volatile directories like Temp/AppData, or run-once triggers) shortly after a file has been downloaded into a temporary or user-writable directory. This pattern is commonly indicative of an adversary establishing persistence for downloaded malware.
Page 184 of 1168