Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,067 copies47 likes38,452 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for processes that are digitally signed by 'Discord Inc.' or 'Lenovo' but executing from file paths that are not associated with legitimate installations of their software. This behavior is indicative of threat actors using stolen or compromised code-signing certificates to bypass security controls like SmartScreen or endpoint antivirus solutions.
Detects a Redis process connecting to a suspected rogue replication master (using non-standard ports or known malicious IPs) followed by a file modification to a system cron directory. This sequence is indicative of a Redis Rogue Replication exploit where a crafted RDB file is used to achieve persistence by writing a malicious entry to a cron job.
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
This rule detects a suspicious sequence of events indicative of a Redis Lua sandbox escape. It monitors for a network connection to Redis (port 6379) followed shortly by the redis-server process reading the system's /etc/passwd file, which is a known indicator of an attempted arbitrary file read via the EVAL command.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
This rule detects access to known malicious domains used in vishing-themed Adversary-in-the-Middle (AiTM) phishing campaigns. Attackers use these domains to deceive users into providing MFA credentials or session tokens, often following a voice phishing interaction where victims are directed to these sites to register or set passkeys.
Detects the execution of known remote access tools (AnyDesk, TeamViewer, Quick Assist) on Windows systems. The rule is intended to be used in a correlated detection pipeline that identifies a multi-stage attack chain involving an initial email-bombing flood followed by an external Microsoft Teams vishing call impersonating IT support.
This rule detects the execution of the AnyDesk remote access tool shortly after its likely download via Microsoft Edge. This pattern is commonly associated with social engineering vishing attacks where an adversary directs a user to download and run remote access software.
This rule detects the execution of common Node.js package managers (npm, yarn, pnpm) attempting to install specific dependencies that match known patterns of malicious or typosquatted packages often used in supply chain attacks. The detection focuses on suspicious package names that mimic common data structure library naming conventions.
This rule monitors email traffic to detect scenarios where a single recipient is receiving a large volume of emails (at least 30 messages) from a high number of unique senders (at least 15) within a one-hour window. This behavior is indicative of a potential bulk spam or phishing campaign targeting a specific mailbox, which may be attempting to overwhelm the recipient or bypass traditional filters through volume.
Page 209 of 1168