Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the C# compiler (csc.exe) initiated by PowerShell. This behavior is often indicative of in-memory compilation and execution of malicious code, bypassing traditional file-based detection.
Detects the execution of PowerShell from a shortcut (.lnk) file, particularly when suspicious command-line arguments such as hidden windows, encoded commands, or bypass flags are utilized. This pattern is commonly associated with initial access via malicious attachments or shortcut files.
This rule monitors for network DNS queries containing keywords commonly associated with credential harvesting and identity verification lures, such as 'sso', 'mfa', 'passkey', or 'helpdesk'. It detects attempts to reach suspicious domains that may be used in phishing campaigns targeting corporate identity portals.
This rule correlates a suspicious process execution (identified by specific command-line indicators), with subsequent persistence modification in Windows Registry Run/RunOnce keys, and a subsequent external network connection (excluding internal IP ranges). The activity is captured within a 15-minute window, suggesting a multi-stage attack pattern involving execution, establishing persistence, and initiating C2 communication.
Detects inbound email messages containing keywords and phrases consistent with extortion attempts, specifically referencing stolen data, unauthorized access, and demands for cryptocurrency payment.
This rule detects incoming HTTP POST requests to the '/api/v1/validate/code' endpoint of a Langflow instance. The rule specifically looks for a JSON key 'code' containing a large, potentially base64-encoded string, which indicates an attempt to exploit CVE-2025-3248 to achieve unauthenticated remote code execution.
This rule monitors for suspicious process execution (e.g., cmd, powershell) spawned from PaperCut service processes (pc-app.exe, tomcat.exe) followed by a Domain Admin group membership change on the same device within a 30-minute window. This behavior is indicative of privilege escalation attempts following the exploitation of PaperCut vulnerabilities (CVE-2026-81578/CVE-2026-82078).
This rule detects potentially malicious child processes (cmd.exe or powershell.exe) spawned by PaperCut application processes (pc-app.exe, PCClient.exe, or java.exe), which may indicate exploitation attempts such as RCE following an authentication bypass.
Detects non-interactive sign-in activity using a Primary Refresh Token (PRT) occurring shortly after a risky or AiTM-flagged interactive sign-in for the same user, originating from a device that has not been previously associated with that user account.
This rule detects instances where a user grants high-risk OAuth application permissions (e.g., Mail or Files access) within 30 minutes of a risky or MFA-challenged sign-in event. This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker successfully steals a session and immediately establishes persistent access to the victim's resources via OAuth consent.
Page 331 of 1168