Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network connections over port 443 to domains that have not been observed in the environment during the preceding 30-day window, specifically targeting domains with character-diversity patterns indicative of algorithmic generation rather than standard human-readable naming conventions.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects potential MFA push fatigue (bombing) attacks by identifying users who receive an abnormal frequency of MFA push notification denials or interruptions within a short window, followed immediately by a successful authentication on a previously unseen device fingerprint. This pattern is characteristic of attackers attempting to wear down users into approving unauthorized login requests.
Detects instances where an administrative, helpdesk, or support account registers or updates security info (such as MFA methods) for a user, specifically when this action is preceded by a password reset for that same user. This pattern is indicative of account takeover attempts, particularly those involving vishing-based social engineering of helpdesk staff to bypass MFA.
Detects the execution of script interpreters (PowerShell, Cmd, Mshta) launched directly from common web browsers (explorer, chrome, edge, firefox). The rule specifically flags common obfuscation techniques such as encoded commands, hidden window styles, or attempts to download and execute code (e.g., IEX, DownloadString) while excluding explicit file-based script executions.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Detects instances where the SQL Server process (sqlservr.exe) initiates command-line utilities such as cmd.exe or powershell.exe, and further identifies suspicious command-line arguments often associated with post-exploitation activity like discovery, credential gathering, or file manipulation.
Detects attempts to terminate common antivirus and security software processes using 'taskkill.exe' with force flags. The rule specifically correlates this behavior with SQL Server processes (initiating or present on the host), suggesting an attempt to disable security controls to facilitate unauthorized activity or persistence.
Page 23 of 1168