Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,067 copies47 likes38,452 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network indicators associated with the ORAX Phishing-as-a-Service (PhaaS) platform. This includes patterns for emoji-matching CAPTCHAs, spoofed Cloudflare security pages, specific wildcard subdomain DNS queries, and the use of anti-analysis gate sequences to prevent sandbox inspection.
Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.
Detects a specific phishing pattern where a legitimate, authenticated DocuSign notification is followed by a user clicking a link within that document that redirects to known malicious infrastructure or OAuth-abuse sites (e.g., .vu domains, credential harvesting proxies). This heuristic identifies the link as being embedded in the shared document rather than the email body.
This rule detects a multi-stage phishing attack sequence: it correlates the receipt of an invoice-themed email containing an anonymous SharePoint link with the subsequent local creation of a Windows Internet Shortcut (.url) file, followed by a Microsoft OAuth device-code authentication sign-in attempt by the user within a short timeframe. This behavior is indicative of an adversary tricking a user into downloading a malicious shortcut that facilitates OAuth device code phishing.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects the presence of the i-Realm companion tool associated with the AnonyMousKIT PhaaS platform, which is designed to bypass iOS Activation Lock features.
Detects artifacts associated with the JWR phishing framework client engine, specifically focusing on the presence of self-referential .toString().search() anti-debugging checks, decoy variable naming conventions, and WebSocket communication components (JWRCID/JWRCVV, ws-worker.js) used for session establishment.
Detects network indicators and session patterns associated with the JWR Phishing Framework, specifically targeting its WebSocket-based command and control (C2) communication, client engine (main.js/ws-worker.js) retrieval, and unique session token (JWRCVV) usage.
Detects DNS queries for domains containing specific brand-related strings (such as government agencies or courier services) coupled with high-risk top-level domains (TLDs). This pattern is frequently used by adversaries to register infrastructure for phishing and social engineering campaigns by mimicking legitimate organizational presence.
Detects the execution of shell interpreters (PowerShell, CMD, Bash, Zsh) with suspicious command-line arguments typically associated with malicious activity, such as encoded commands, hidden window styles, or network download requests, when initiated by common user-facing applications like web browsers or Windows Explorer.
Page 208 of 1168