Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,239 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Microsoft Office applications (Word, Excel, Outlook, PowerPoint) spawning common LOLBins or command-line interpreters. This behavior is frequently associated with malicious macros or exploitation attempts delivering secondary payloads.
Detects ClickFix-style attacks where a user is tricked into copying and pasting malicious, often obfuscated, commands into the Windows Run dialog or a command prompt. The detection identifies suspicious parent processes (like explorer.exe) spawning shell interpreters (powershell.exe, cmd.exe, mshta.exe) with inline encoded payloads or remote content retrieval patterns. It correlates these process executions with recent entries in the Windows RunMRU registry key to identify commands triggered via the Run dialog.
Detects potential scanning and exploitation attempts against Oracle PeopleSoft Environment Management Hub (PSEMHUB) endpoints, specifically targeting CVE-2026-35273. The rule monitors Azure Application Gateway logs for suspicious HTTP methods (PUT, DELETE, OPTIONS, TRACE) or parameters (e.g., directory traversal strings, command injection indicators) combined with high-frequency sequential probing patterns.
Detects an attempt to exploit CVE-2026-88772 by identifying an oversized DTLS handshake record on a NetScaler Gateway. The rule looks for UDP traffic on port 443 where the initial handshake record exceeds the expected size threshold, indicative of a potential buffer overflow attempt.
Detects high-frequency, short-duration UDP flow activity on NetScaler VPN ports (443/4433) indicative of volumetric or malformed DTLS handshake probing, potentially associated with exploitation attempts like CVE-2026-88772.
Detects the execution of Python-based tunneling tools located in the 'C:\Users\Public\indigo\' directory, which is a known staging location for malicious implants used in covert tunneling operations.
Detects instances where a PowerShell session is initiated from Windows Terminal (wt.exe) and subsequently executes a command to download an archive file (e.g., .zip) using common download cmdlets or methods. This pattern is often indicative of an attacker downloading and staging malicious payloads.
Detects the loading of an unsigned or untrusted kernel driver followed by the termination of known security (AV/EDR) processes within a 10-minute window. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation often used by ransomware actors to bypass endpoint security controls.
Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.
Detects instances where a process that is not a recognized web browser (chrome, msedge, firefox, brave, opera, or explorer) accesses multiple unique browser cookie files. This is a common pattern for credential harvesting malware attempting to steal browser sessions.
Page 3 of 1168