Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,115 copies47 likes38,518 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized access attempts to a Docker Registry API on port 5000. The rule identifies attempts to enumerate the image catalog and extract sensitive environment variable information from configuration blobs, which may contain hardcoded credentials or indicators of compromise.
Detects network communication associated with the CARBONATO Hermes Agent, including direct C2 beaconing to a hardcoded IP on port 8989 and TLS connections to Vercel-hosted proxy infrastructure identifying as 'carbonato-proxy'.
Detects a specific command and control (C2) communication pattern characteristic of RatHat malware, involving the retrieval of HTML overlay templates followed by the submission of captured form or credential data from the same device within a one-hour window.
Detects a specific sequence of Android Debug Bridge (ADB) commands typical of malicious Android agents, specifically those running with elevated privileges (UID 2000/shell/root). The rule identifies combinations of permission grants, battery optimization bypasses, and package tampering (disabling or uninstalling) occurring within the same context.
Detects a specific sequence of Android Debug Bridge (ADB) commands typical of malicious Android agents, specifically those running with elevated privileges (UID 2000/shell/root). The rule identifies combinations of permission grants, battery optimization bypasses, and package tampering (disabling or uninstalling) occurring within the same context.
Detects a specific sequence of commands indicative of the RatHat malware on Android, involving waking the device followed by automated unlock gestures or PIN input and password retrieval commands.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
Detects instances where msiexec.exe is used in conjunction with specific application names (Spotify, Zoom, Teams) in the command line, and subsequently launches suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe with specific script or executable arguments. This pattern is often associated with malicious installers or trojanized software attempting to execute embedded payloads.
Detects the CARBONATO botnet using two distinct persistence and evasion techniques: masquerading user-space processes as kernel worker threads by setting command line arguments to '[kworker/u2:0]', or disguising mining binaries as the systemd-logind service. Legitimate kernel threads are spawned by PID 2 and lack an executable path, while the legitimate systemd-logind is expected to be spawned by systemd/init.
Detects the compilation of a Managed Object Format (MOF) file using mofcomp.exe from the temporary directory of the MSSQL service account. This behavior is indicative of an attacker leveraging the xp_cmdshell procedure in MSSQL to deploy a malicious MOF file, which registers a WMI permanent event subscription to establish persistence or facilitate secondary payload execution.
Page 245 of 1168