Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,115 copies47 likes38,518 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a successful authentication to Microsoft SQL Server using the 'sa' account from a non-local address. This rule is designed to alert on potentially unauthorized access following a brute-force attack, as identified by the correlation of high-volume authentication failures (Event ID 18456) followed by a successful login (Event ID 18453/18454).
Detects the removal of persistence mechanisms related to the 'ComponentTask33Agent' task, specifically the deletion of a scheduled task or registry Run key, followed by the deletion of associated files within specific Microsoft-themed AppData subdirectories within a 30-minute window.
Detects the persistence sequence associated with 'ChainScript', which involves creating a hidden scheduled task using PowerShell or specific scripts, and a fallback mechanism that creates a registry run key entry if the task creation fails. The rule monitors for PowerShell commands, bridge script execution, and registry modifications involving the 'ComponentTask33Agent' or wscript.exe executing an '_agent.vbs' file.
Detects the creation of a local administrative account with a hidden naming convention (ending in $) accompanied by a cluster of registry modifications designed to obscure the account from the logon screen, enable WDigest plaintext credential caching, relax RDP authentication requirements (disable NLA, enable RDP), and disable UAC remote restrictions. This activity is highly indicative of post-exploitation persistence and credential harvesting configurations following initial access via SQL server exploitation.
Detects the creation of specific forensic log files (browser_decryption.log, sends.log) within the %TEMP% directory. These files are indicators of the data collection stage performed by the Rapuncel infostealer prior to archiving and exfiltration.
Detects execution of an XMRig cryptominer masquerading as the legitimate system process 'smss.exe' from a non-standard file path. This detection specifically identifies the presence of the WinRing0x64.sys kernel driver, often used by XMRig for hardware MSR access, and detects preceding malicious activity involving UnRAR extraction of the miner using a specific password.
Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.
Detects network activity associated with the RatHat Android malware, specifically the exfiltration of accessibility tree data and calls to Google's Generative Language API (gemini-2.5-flash-lite) for UI target resolution and automation.
Detects the presence of known RatHat Go-based command agents (liblocal-service.so) or frpc reverse-proxy clients (libmedia_codec.so) when staged within temporary directories such as /data/local/tmp on Android devices, often following manual ADB shell interaction.
Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.
Page 246 of 1168