Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,073 copies47 likes38,459 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-volume, unauthenticated or anonymous requests (GetObject, ListObjects, ListObjectsV2) against AWS S3 buckets. This behavior is consistent with mass enumeration or scanning activities often associated with data exfiltration attempts against misconfigured publicly-exposed storage buckets.
Detects OAuth application consent requests that combine broad API access scopes with persistence-enabling scopes (e.g., offline_access or refresh_token). This pattern is consistent with OAuth consent phishing attacks, where adversaries attempt to gain non-interactive, long-term access to an organization's cloud environment via malicious connected applications.
Detects high-volume data transfers (exceeding 100MB) from internal sources to known external cloud storage and file-sharing platforms. This behavior is consistent with data staging and exfiltration patterns, often used by threat actors to move collected data to attacker-controlled storage infrastructure.
Detects high-privilege account management actions in Entra ID (password resets or MFA modifications) performed by service or admin accounts, which are characteristic of social engineering (vishing) attacks targeting IT helpdesks to gain unauthorized access.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.
Detects Node.js processes exhibiting network activity patterns consistent with 'EtherHiding' style C2 infrastructure, characterized by multiple distinct connections to external WebSocket hosts on non-standard TCP ports within a short timeframe, potentially following interaction with a blockchain/JSON-RPC endpoint.
Detects a UAC bypass sequence associated with the ChainScript/Rapuncel loader, where a process invokes an 'elevation:Administrator!new' COM moniker (such as CMSTPLUA or ICMLuaUtil) followed by the execution or hollowed-out spawning of 'ServiceModelReg.exe' to achieve elevated privileges.
Detects anomalous file staging activity combined with keyword-matched file access or suspicious Steam application launches, characteristic of the Rapuncel (BoryptGrab) malware's credential and crypto-wallet harvesting routine.
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Page 215 of 1168