Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,530 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound network traffic from internal hosts to known IP addresses associated with Exvicy Malware-as-a-Service (MaaS) Command and Control (C2) or hosting infrastructure. This rule acts as an indicator of compromise (IOC) match to identify potential infected hosts communicating with malicious external servers.
Detects HTTP POST requests to SharePoint ToolPane or WebPartPage endpoints containing serialized gadget chains (e.g., ysoserial ExpandedWrapper/ObjectDataProvider or XamlServices) indicative of deserialization exploitation attempts, specifically targeting CVE-2026-65660.
Detects unauthenticated HTTP POST requests targeting SharePoint WebPartPage-derived endpoints using the 'webPartMarkup' parameter. This activity attempts to exploit a vulnerability (CVE-2026-65660) where anonymous access to specific pages bypasses authentication, allowing an attacker to invoke internal methods for malicious register-directive injection.
Detects instances of PowerShell being launched directly by Windows Explorer (explorer.exe), which is indicative of a user interacting with the 'Run' dialog (Win+R). The rule specifically flags common ClickFix social-engineering patterns, such as hidden windows and the use of download/execution cmdlets (e.g., Invoke-WebRequest, Invoke-RestMethod) used to fetch and run remote payloads.
Detects malicious exploitation attempts against the SharePoint WebPartPages.asmx SOAP endpoint. Attackers use this endpoint to bypass security patches by invoking template-parsing functions like GetWebPartPageConnectionInfo, which facilitates Register-directive injection and XamlServices deserialization chains for remote code execution.
This rule detects obfuscated JavaScript payloads characteristic of the Exvicy malware distribution framework (a successor to ErrTraffic) being served via compromised WordPress pages. The detection logic searches for specific obfuscation patterns and 'human verification' lures within HTTP response bodies on web proxies.
This rule detects DNS queries, TLS Server Name Indication (SNI) lookups, and HTTP Host header requests directed towards a list of known domains associated with 'Exvicy' malicious activities (lure domains).
This rule detects DNS queries for domains that are categorized as Newly Registered Domains (NRD) or Newly Observed Domains (NOD) and are using specific Cloudflare nameserver pairs (randy.ns.cloudflare.com and stevie.ns.cloudflare.com). These specific nameservers have been identified as part of the infrastructure used by the Exvicy malware distribution framework to manage its disposable, short-lived domain portfolio.
This rule detects HTTP POST requests indicative of the RevStealer malware interacting with a Polygon blockchain smart contract via a public RPC endpoint. The rule specifically looks for 'eth_call' JSON-RPC methods targeting a known malicious contract address and a specific function selector ('0xd8b0d6ad') often used in RevStealer's command-and-control failover operations.
Detects outbound HTTP POST requests associated with the VelvetCake malware and Konni threat actor to the command-and-control (C2) domain 'medianewsonline.com'. The rule matches specific URI patterns ('/logout.php') and query parameters ('OKey=', 'Who=', 'Areyou=') commonly used for reconnaissance and data exfiltration.
Page 283 of 1168