Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,292 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects network connections initiated by unsigned executables that were recently created (within one hour) in common staging directories such as AppData, Temp, or ProgramData. It specifically targets beacons to the Telegram Bot API or Discord webhooks, which are common patterns for command-and-control (C2) communication used by malware such as the Amadey bot.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects the creation or modification of scheduled tasks (crontab entries) initiated by processes commonly associated with Citrix NetScaler ADC/Gateway appliances (nsppe, httpd, nscollect). This behavior is often indicative of persistence mechanisms used by attackers following an initial exploit on an edge network device.
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects anomalous NetScaler session activity potentially indicative of session hijacking or token forgery. This includes identifying session tokens reused across different source IP addresses or user-agents within a short timeframe, as well as detecting session tokens utilized in traffic without a preceding recorded authentication or logon event.
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects the use of common PowerShell techniques designed to bypass the Antimalware Scan Interface (AMSI). These techniques involve manipulating internal PowerShell objects like AmsiUtils or amsiInitFailed, or using reflection to locate and modify AMSI memory structures to disable scanning.
Detects suspicious activity associated with Cobalt Strike Beacon communication, specifically monitoring for known default named pipes and specific user-agent strings commonly used by Cobalt Strike in HTTP/S traffic.
Page 29 of 1168