Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,543 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects credential-stuffing campaigns that employ AI/ML-tuned inter-request timing jitter to bypass traditional rate-limiting and fixed-interval bot detection, specifically flagging interactive or network logon failures on Windows hosts.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Detects the loading of 'clr.dll' and 'System.Management.Automation.dll' (or related variants) by a process that is not a known PowerShell host. This behavior is indicative of a 'PSInline' execution technique, where an attacker leverages COM or direct assembly loading to execute PowerShell scripts or commands within a benign or malicious process to avoid spawning explicit powershell.exe processes.
Detects the execution of a renamed Microsoft CoreCLR Debugger (vsdbg.exe) from a directory outside of standard Visual Studio installation paths. This behavior is indicative of DLL side-loading, where a malicious vsdbg.dll is planted alongside the renamed vsdbg.exe, a technique observed in malware loader chains like Rapuncel/BoryptGrab.
Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.
This rule detects email activity containing keywords related to SSO or passkey updates combined with urgent terminology and support request language. This pattern is commonly indicative of phishing attempts aimed at stealing credentials or tricking users into providing sensitive information.
Detects rapid TCP connection attempts to port 445 (SMB) from a single source IP address, indicative of network scanning or reconnaissance activities typically used by the DragonForce ransomware or similar automated threats for lateral movement.
Detects outbound HTTP requests to 'relay.php' that include the 'X-Captcha-Track: 1' header, which serves as a telemetry beacon for the CRPx0 ClickFix social engineering campaign. This activity is indicative of a user interacting with a malicious webpage designed to trick them into executing harmful commands via copy-paste actions.
This rule detects potentially malicious command execution by monitoring additions to the Windows Explorer RunMRU registry key. It specifically triggers when the registry data contains references to 'powershell', 'curl', or appears to be encoded/base64 strings, which are often used by adversaries to execute malicious scripts or download payloads via the Run dialog.
Detects file operations (open, read, write, rename) involving common sensitive credential files (e.g., .kdbx password databases, .ovpn and .pcf configuration files, .pem, and .ssh directory contents) by processes not authorized to interact with these files.
Page 345 of 1168