Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,065 copies47 likes38,448 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects signs of Zerologon (CVE-2020-1472) exploitation by correlating Netlogon (MS-NRPC) authentication anomalies involving known exploitation tools/process names with subsequent machine-account password reset events (Event ID 4742) occurring on the same device within a short time window.
Detects anomalous AI agent behavior characterized by a significant spike in resource or tool invocations within a 15-minute window, potentially indicating indirect prompt injection or unauthorized agent hijacking where an agent is coerced into excessive or unauthorized actions.
Detects a multi-stage process execution chain beginning with common end-user applications (browsers, Office apps, explorer.exe) spawning known LOLBins (Living-off-the-Land Binaries), which in turn execute secondary LOLBins with suspicious command-line indicators. This pattern often signifies post-exploitation activity such as secondary payload delivery, fileless malware execution, or proxy execution of malicious scripts/commands, consistent with ClickFix or BYOVD-related ingress techniques.
This rule detects potential 'ClickFix' phishing activity where a user is tricked into executing malicious commands in a Windows shell. The rule looks for browser or file explorer processes acting as the parent process to command-line interpreters (cmd.exe, powershell.exe, etc.) executing suspicious command-line arguments often used to fetch or run malicious scripts from the internet.
Detects anomalous child process execution from SharePoint's w3wp.exe worker process following the loading of suspicious .NET assemblies (PresentationFramework.dll, System.Xaml.dll, System.Data.Services.dll). This behavior is indicative of a post-exploitation stage for SharePoint SafeControls bypass vulnerabilities, where a gadget chain is utilized to execute unmanaged or child processes.
Detects the 'ClickFix' social engineering attack where a user is instructed to use the Windows Run dialog (Win+R) to execute a malicious one-liner. This activity is characterized by explorer.exe spawning common command/script interpreters (powershell, cmd, mshta, etc.) containing typical download-and-execute strings (cradles), which bypasses browser-based download security controls.
Detects the use of PowerShell script blocks that attempt to bypass or disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by interacting with internal .NET objects or DLLs, a common technique in phishing-delivered payloads.
Detects mshta.exe or rundll32.exe spawned as a direct child of explorer.exe with a remote HTTP/HTTPS URL or javascript: URI as an argument. This pattern is indicative of ClickFix-style phishing campaigns where users are socially engineered into running malicious commands via the Windows Run dialog or clipboard, leading to execution of remote malicious payloads proxied through trusted system binaries.
Detects the execution of Python interpreters from user-writable directories (Temp, Downloads, AppData) when launched by common LOLBins or shell-like parents, which is indicative of the CastleLoader 'ClickFix' phishing chain where attackers deploy a portable Python runtime to execute malicious payloads.
Detects the execution of NetSupport Remote Access Tool (RAT) components (client32.exe, Nskbfltr.sys, or TCCTL32.dll) from locations outside of the standard program installation directories. This behavior is often indicative of unauthorized persistence or masquerading by malware utilizing remote support software for C2.
Page 204 of 1168