Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects a potential brute force attack against the Microsoft SQL Server 'sa' administrative account. It identifies a high volume of failed authentication events (Event ID 18456) for the 'sa' account within a 10-minute window, followed by a successful authentication event (Event ID 18453 or 18454) from the same source IP address. The rule specifically filters for successful logins originating from non-private (internet-facing) IP addresses, suggesting an attempt from an external threat actor.
Detects the RatHat ADB self-pairing sequence on Android devices, where an application uses shell-level access gained via ADB to stage and execute malicious binaries (such as Go Agents or FRP clients) from /data/local/tmp. The rule correlates the staging and execution of these specific binaries with subsequent network communication indicative of C2 or data exfiltration.
Detects the loading of known DLLs (WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, nvml.dll) from suspicious or non-standard file paths. The rule cross-references these image loads with file activity, identifying potential side-loading scenarios where a library is loaded from an unexpected directory or within an archive-related context. It also includes an explicit hash-based detection for a known malicious file.
Detects the specific behavior of the NeedyMantis malware where a file named 'encryptbase64.ps1' is written to disk but is not subsequently invoked by any PowerShell process. This is indicative of shellcode masquerading as a script file, where the file is loaded directly into a process's memory to perform ROR-based API hashing and unpacking of a minimized PE loader.
This rule monitors for sustained, repeated network connections from specific processes (often legitimate binaries used by the NeedyMantis group for loader activities) to known NeedyMantis-associated C2 domains. It triggers when an initiating process, associated with known loader activity, maintains a persistent communication pattern consistent with an active WebSocket C2 session.
Detects the FileFix execution chain, where victims are socially engineered into pasting a malicious path into the Windows Explorer address bar. This action results in explorer.exe launching suspicious command-line tools (cmd.exe, powershell.exe, wscript.exe, or cscript.exe) with suspicious flags or unusually long, potentially obfuscated arguments characteristic of a 'ClickFix' style attack.
Detects potential exploitation of Active Directory Certificate Services (AD CS) misconfigurations (specifically ESC1, involving client-auth EKU and enrollee-supplies-subject). The rule correlates certificate issuance events (4886, 4887, 4888) involving sensitive templates or suspicious subject alternative name (SAN) mismatches with subsequent Kerberos PKINIT authentication (4768) events using the issued certificate.
This rule detects potential Multi-Factor Authentication (MFA) push-bombing, also known as MFA fatigue, where an adversary floods a user with push requests in hopes that the user eventually approves one. The rule flags instances where a successful MFA push approval is preceded by five or more failed, denied, or timed-out MFA push notifications within a 15-minute rolling window for the same user.
Detects MFA push-bombing or authentication fatigue attacks where an adversary repeatedly triggers MFA challenge requests for a user in a short period, potentially from multiple IP addresses, culminating in a successful authentication event. This behavior is indicative of an attacker attempting to coerce a user into approving an MFA request.
Detects the execution of the Windows finger.exe utility with a command-line argument containing an '@' symbol, which indicates a request to a remote host. This technique is often abused by adversaries for reconnaissance or to retrieve remote stagers or other payloads, as the finger protocol is rarely used in modern enterprise environments.
Page 24 of 1168