Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,064 copies47 likes38,439 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound HTTP requests to 'third-party.com', a domain identified as being associated with 'ClickFix' social engineering lures, which are commonly used to deceive users into executing malicious scripts or downloading payloads.
This rule detects Terraform CLI activity interacting with suspicious domains or modules, specifically targeting known repositories or namespaces (e.g., gocommunity.io, gogets.dev). It monitors for Terraform initialization or application patterns referencing these domains in process command lines, as well as the creation of Terraform provider files within these specific namespaces. This behavior is indicative of potential supply chain compromise involving malicious Terraform modules or dependencies.
Detects critical log entries on MikroTik RouterOS devices that contain 'flagged' status messages following a system upgrade or maintenance. This pattern is indicative of potential post-exploitation activity or post-update integrity warnings identified in recent vulnerabilities affecting RouterOS.
Detects the execution of the Graphalgo RAT second-stage payload. The rule identifies the spawning of a detached 'go run .' process, which performs an ephemeral key exchange using a hardcoded public key before C2 establishment. It also correlates this activity with parent processes common in software build environments (npm, terraform, go) to differentiate malicious staging from developer activity.
Detects the 'ClickFix' technique where a user is socially engineered into copying a malicious command to their clipboard and pasting it into the Windows Run dialog (Win+R). The rule monitors for powershell.exe spawned by explorer.exe containing specific social engineering keywords or typical fileless download-execute patterns like 'irm', 'iex', or 'Invoke-RestMethod'.
This rule detects the suspicious use of signed Windows binaries (rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe) to execute remote content via URLs or scripts, or when triggered by common office applications and browsers. This behavior is often indicative of living-off-the-land (LotL) techniques used for download/execution of payloads or bypassing security controls.
Detects the creation of new Windows services using sc.exe or PowerShell where the binary path is located in common user-writable or temporary directories (e.g., Temp, AppData, ProgramData), or where the service name mimics legitimate Windows system services, a technique often used for persistence or lateral movement (e.g., PsExec).
Detects anomalous Kerberos ticket requests that are characteristic of Golden Ticket attacks. The rule flags the use of weak encryption types (e.g., RC4) commonly used in forged tickets even in AES-enforced environments, and direct requests for the KRBTGT service account outside of legitimate ticket renewal operations.
This rule identifies potential RDP-based lateral movement by detecting when a single user account successfully authenticates to multiple distinct hosts using LogonType 10 (RemoteInteractive) within a 1-hour time window. A threshold of three or more distinct hosts is used to flag activity that deviates from typical single-host RDP usage.
Detects the use of legitimate Windows binaries (LOLBins) certutil.exe and bitsadmin.exe for suspicious activities such as downloading files via URL or decoding encoded files. This rule explicitly excludes known legitimate administrative activity originating from Microsoft Configuration Manager (SCCM).
Page 193 of 1168