Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,530 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous, high-volume, low-severity events flagged for human review originating from a single AI agent or source within a 10-minute window. This behavior is indicative of an adversary flooding the human-in-the-loop (HITL) review queue with chaff data (noise) to exhaust analyst capacity or conceal malicious activity.
This rule detects potential AI model training data poisoning attempts by monitoring data pipeline audit logs for suspicious activities. Specifically, it flags bulk modifications to production training sets, ingestion from newly introduced external sources, or failures in data integrity checksums, which are indicative of attempts to influence or corrupt machine learning model training pipelines.
Detects instances where Windows Terminal (WindowsTerminal.exe) is launched by Explorer and immediately spawns a shell process (PowerShell, PWSH, or CMD), specifically excluding devices that have recorded recent RunMRU registry history. This pattern may indicate suspicious or non-interactive execution by an adversary attempting to bypass traditional shell history tracking.
Detects the use of nodejs.exe to initiate external network tunnels to known tunneling services like pinggy.io or generic tunnels using common tunnel configuration flags.
Detects the execution of PowerShell or Command Prompt with common adversarial flags (e.g., encoded commands, bypass, hidden windows) initiated by the Windows Explorer process. This pattern correlates the execution event with recent user interaction with the Windows Run MRU registry key, suggesting a possible manual execution of malicious commands via the 'Run' dialog box.
Detects usage of msiexec.exe to execute an MSI package from a remote URL. This technique is often used to download and execute malicious installers directly from the internet, bypassing local file storage.
This rule detects the execution of a specific MSI package identified by its filename and hash (MD5/SHA256). The rule monitors 'msiexec.exe' process executions and alerts when the process command line or file hash matches a known malicious indicator.
Detects the execution of cmd.exe as a child process of msiexec.exe, specifically when the command line includes 'xupdate.bat' and references a suspicious file path within 'AppData\Roaming\Traiolx Custom Utils'. This pattern is indicative of potential malicious installer abuse or software updates being used for code execution.
This rule monitors for the presence of a file named '_socket.pyd', which is a standard Python library component. The alert triggers when this file appears within a specific directory path 'Traiolx Custom Utils' or matches a known file hash associated with potentially malicious activity or unauthorized use of Python modules.
Detects the execution of 'mshta.exe' loading an .hta file containing specific suspicious terms ('VLC', 'Presentation', 'Denver'), followed by the spawning of child processes such as 'wscript.exe', 'cscript.exe', 'powershell.exe', 'cmd.exe', or 'wmic.exe'. This pattern is frequently used to proxy execution of malicious scripts via legitimate Windows binaries.
Page 286 of 1168