Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,534 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential Business Email Compromise (BEC) fraud involving AI voice-cloning. The rule correlates external or unrecognized Microsoft Teams activity (calls/chats) directed at finance users with high-value financial transactions or vendor bank detail updates occurring on the same day, specifically when these transactions lack evidence of legitimate out-of-band or second-approver verification.
Detects the use of the 'finger.exe' utility in a suspicious manner, indicative of payload staging in a 'ClickFix' phishing attack scenario. The rule monitors for instances where 'finger.exe' is executed with suspicious command-line arguments (containing '@' or '-l') by common parent processes associated with malicious copy-paste activities (cmd.exe, powershell.exe, or explorer.exe).
Detects instances where a user grants consent to an unverified OAuth application requesting high-privilege scopes (e.g., Mail.Read, Files.ReadWrite.All). This behavior is characteristic of consent phishing attacks aimed at obtaining persistent access to sensitive data and mailbox contents.
Detects network requests originating from mobile device user-agents to suspected phishing or OAuth-consent URLs. This rule identifies patterns common in 'quishing' (QR-code phishing) campaigns where a mobile device is used to interact with a malicious redirect chain or credential-harvesting page. It excludes known legitimate OAuth authorization flows to reduce noise.
Detects ClickFix-style browser or explorer spawned command execution using clipboard-paste patterns, or subsequent ransomware-related discovery and inhibit-system-recovery commands such as net.exe, nltest.exe, and vssadmin.exe used after initial access.
Detects a sequence of suspicious activities associated with EvilTokens-style session hijacking. This includes the identification of non-interactive sign-in events involving the redemption of a refresh token without secondary MFA, followed by the creation or modification of Exchange Online mailbox rules to facilitate unauthorized email forwarding or exfiltration.
Detects a multi-stage Telephone-Oriented Attack Delivery (TOAD) campaign. The first stage identifies phishing emails containing billing or security-themed subjects and phone numbers without links or attachments to evade automated analysis. The second stage monitors for the subsequent installation or execution of common remote-support tools (e.g., AnyDesk, TeamViewer, ScreenConnect). A final correlative rule detects these events occurring sequentially on the same host, indicating a high-confidence indicator of a successful callback phishing social-engineering attempt.
Detects an anomalous volume of artificial intelligence model inference API calls (e.g., AWS Bedrock, Azure OpenAI, Google Vertex AI) initiated by a single IAM principal or API key within a short time window. This activity is indicative of 'LLMjacking', where compromised cloud credentials are leveraged by threat actors to perform unauthorized, high-cost AI model inference tasks.
Detects instances where an AI agent's persistent memory store is updated with suspicious content (e.g., prompt injection, role overrides, or embedded credentials) by a user other than the authorized agent owner, followed by subsequent tool invocations in an independent session. This behavior aligns with prompt injection attacks aimed at manipulating agent logic and unauthorized resource access via the AI agent.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Page 292 of 1168