Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,543 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the execution of HTSPnew.Exe with specific command-line arguments indicative of KRSID ransomware operations, such as configuration flags for paths, batch processing, and dry-run modes. The use of these flags with this specific executable name is a strong indicator of malicious activity.
Detects the creation of files with the name 'README_KRSID.Txt', which is a hallmark behavior of the KRSID ransomware strain used to leave ransom notes on compromised systems.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
This rule detects a multi-stage Business Email Compromise (BEC) attack involving executive impersonation via look-alike domains, followed by the creation of suspicious inbox rules (forwarding/deletion) by the victim, and concurrent external communication (Teams/Zoom meeting invites) from a newly created account. It correlates these activities to identify sophisticated payment fraud campaigns.
Detects the presence of KRSID ransomware by identifying specific embedded strings associated with its configuration, including ransom notes (README_KRSID.Txt), log files (ransomware-silent.Log), encrypted file extensions (.krsid), and common command-line arguments used for operational control.
This rule detects potential 'Quishing' (QR code phishing) attempts by identifying email-based phishing detection or malicious URL indicators followed by a user clicking the URL and subsequently authenticating to a corporate system from a mobile device (Android or iOS) within a 30-minute window. This behavior often suggests an adversary successfully harvesting credentials via a QR code link and then using them to gain unauthorized access.
Detects the execution of files related to 'UBPPatch' or 'HTSPnew', specifically looking for PowerShell scripts (.psh) or executables (.exe) that match these potentially non-standard or obfuscated update/patch filenames. The rule also looks for command lines referencing 'Update.Lst', often associated with custom or unauthorized patch mechanisms.
Page 338 of 1168