Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,519 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential persistence establishment in M365 environments following anomalous or risky sign-in events. This pattern is characteristic of Adversary-in-the-Middle (AiTM) attacks where a session cookie is stolen, followed by immediate adversary actions to secure long-term access, such as MFA method registration, OAuth app consent, or mailbox rule configuration.
Detects web proxy requests that resemble phishing attempts targeting Apple Activation Lock. The rule identifies URLs containing specific Apple-related keywords in combination with common phishing URL paths, while filtering out legitimate Apple support documentation pages.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects web proxy requests that resemble phishing attempts targeting Apple Activation Lock. The rule identifies URLs containing specific Apple-related keywords in combination with common phishing URL paths, while filtering out legitimate Apple support documentation pages.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule detects known JavaScript payloads associated with the JWR phishing framework by matching their SHA-256 file hashes. This is a signature-based detection for malicious script files commonly used in phishing attacks.
This rule detects network connections (TLS SNI and HTTP requests) to domains associated with the AnonyMousKIT PhaaS (Phishing-as-a-Service) platform. It flags connections to known phishing backend domains and monitors for access to suspicious management dashboard paths commonly utilized by this threat actor for managing phishing orders and communications.
Detects network activity associated with the JWR Phishing Framework, specifically focusing on the initiation of a WebSocket upgrade request following the delivery of a checkout-themed page load containing a 'cart_data' parameter, which is characteristic of the framework's C2 communication flow.
Page 256 of 1168