Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,236 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Active Directory DCSync replication requests by monitoring for Event ID 4662 associated with DS-Replication-Get-Changes or DS-Replication-Get-Changes-All extended rights. The rule triggers when these rights are requested by an entity (subject) originating from a host that is not recognized as a Domain Controller.
This rule detects potential privilege escalation in cloud environments (AWS, Azure, GCP) by identifying the attachment or update of overly permissive policies (e.g., wildcard permissions or administrative roles) followed by rapid execution of high-privilege actions (like creating new users, keys, or profiles) by the same actor within 15 minutes.
Detects signs of exploitation targeting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257). The rule identifies an initial network request with invalid or malformed session cookies aimed at GlobalProtect endpoints, followed immediately by unauthorized access attempts to administrative portal interfaces from the same source IP address.
Detects the spawning of shells, interpreters, or system reconnaissance binaries by primary Citrix NetScaler ADC/Gateway processes (httpd, nsppe, aslearning). This behavior is strongly indicative of post-exploitation activity, such as remote command execution, often following the exploitation of vulnerabilities like CVE-2026-88771.
Detects the creation or modification of system users and groups on NetScaler ADC/Gateway appliances by monitoring Syslog events (e.g., nsconmsg, audit logs). The rule specifically triggers when these actions occur outside of standard business hours or on weekends, indicating potential unauthorized account manipulation or unauthorized persistence mechanisms.
Detects when an AI agent or assistant process attempts to access sensitive local configuration or credential files (e.g., .aws/credentials, .env, id_rsa, service account keys, .netrc) that typically fall outside the scope of its intended function. This behavior is indicative of unauthorized access, potentially due to prompt injection or malicious exploitation of the agent's file system permissions.
Detects outbound HTTP requests to a known C2 domain (letsdiskuss.com) and a specific URI path, characteristic of the 'Lorem Ipsum' malware loader's dead-drop resolver lookup.
This rule detects potential DLL sideloading activity associated with the Lorem Ipsum Loader. It monitors image load events to identify specific legitimate Windows binaries (often used for sideloading) that load non-system DLLs. The rule filters out legitimate DLL loads from standard Windows system directories to highlight anomalous behavior.
Detects chained AWS STS AssumeRole/AssumeRoleWithSAML/AssumeRoleWithWebIdentity events where a principal assumes a role in a different account and then quickly performs another role assumption from that new context. This pattern, often referred to as 'role chaining' or 'role laundering', is frequently used to obfuscate identity tracking and facilitate lateral movement across AWS account boundaries.
Detects instances where a user account registers or modifies MFA authentication methods (such as phone numbers or apps) for a different user account. This behavior is indicative of an attacker with administrative privileges attempting to establish persistence on a target account by adding their own MFA device.
Page 2 of 1168