Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,071 copies47 likes38,455 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the specific behavior associated with the OnyxC2 C2 framework where a process re-spawns a child instance of itself, followed by a rapid registry modification by that child process. This pattern serves as a marker for the ONYXC2 loader configuration stage.
Detects unauthorized processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with high-privilege access masks, a technique commonly used for credential dumping to harvest passwords and authentication tokens.
Detects the use of WinRAR to open or extract password-protected ZIP archives containing 'Setup_File' in the filename, immediately followed by the execution of a file extracted into a WinRAR temporary directory. This behavior is associated with the OnyxC2 delivery chain, where attackers use password-protected archives to bypass security scanning.
Detects the use of PowerShell processes that employ command-line encoding (e.g., -enc, -EncodedCommand) in conjunction with download-related cmdlets (e.g., DownloadString, IEX, Invoke-WebRequest), or instances of PowerShell spawned as a child process of another PowerShell process. This pattern is indicative of a loader or stage-one script fetching additional malicious payloads.
Detects suspicious non-interactive Entra ID sign-in events using the 'python-requests' User-Agent against sensitive Microsoft resources such as Microsoft Graph, Device Registration, or Intune. This activity is indicative of automated token abuse, particularly in the context of device-code phishing kits (e.g., GhostCode), where an attacker uses stolen session information to interact with Microsoft APIs.
This rule detects HTTP POST requests to the 'wp-login.php' endpoint of a WordPress installation where the 'log' (username) and 'pwd' (password) fields are both set to 'admin'. This is a common signature for automated brute-force or credential-stuffing attacks targeting default administrator credentials.
Detects high-frequency connection attempts from a single source IP to multiple destination IPs over the non-standard DVRIP port 37777, often used by Dahua surveillance equipment. This behavior is indicative of automated scanning, brute-forcing, or exploitation attempts targeting vulnerable IoT/CCTV devices.
Detects the addition of new members to a GitHub organization or team outside of standard business hours. This behavior is correlated with potential subsequent grants of repository administrative access or read access to secrets, characteristic of attacker patterns attempting to gain unauthorized access to cloud environments and OAuth tokens via CI/CD pipelines or VCS platforms.
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Detects OAuth application consent events in Entra ID where the application display name mimics legitimate services like Salesforce or Data Loader while requesting high-risk API scopes (full_access, offline_access, api). This behavior is characteristic of phishing-driven OAuth grant campaigns, such as those observed by the ShinyHunters group.
Page 212 of 1168