Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,546 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where a parent Node.js process spawns a child Node.js process using a command line structure often associated with malicious npm packages. These packages frequently attempt to execute loader scripts in a detached or background manner to evade detection while maintaining persistence or performing malicious operations.
Detects instances where a Node.js process spawns another Node.js process as a child. This behavior is often associated with malicious npm packages attempting to evade detection during runtime execution or executing secondary malicious payloads.
Detects high-volume email inflow to a single recipient mailbox within a 15-minute timeframe. The rule specifically monitors for subject lines commonly associated with subscription confirmations or newsletters, indicating a potential email bombing or mail flood attack designed to overwhelm a user's inbox or hide malicious communications.
Detects Microsoft 365 Exchange MailItemsAccessed operations performed by a specific ClientAppId and AppId known to be associated with an exfiltration toolkit. This activity indicates unauthorized access to mail items, consistent with data harvesting efforts.
Detects the presence of file artifacts associated with the Xray-core proxy tool when used as an implant via DLL sideloading. The rule identifies specific files (radcui.dll, config.json, comsrv.dat, KB85809588.bat) or malicious configuration patterns indicating proxy traffic (VLESS/VMess/outbound/inbound) targeting known C2 endpoints.
Detects persistence attempts using Component Object Model (COM) hijacking by modifying HKCU CLSID InProcServer32 registry keys. The rule specifically identifies instances where the registry value points to a DLL file located within the user's AppData or LocalAppData directories, excluding typical system or program directories, as seen in sideloading persistence chains.
Detects outbound network traffic from internal hosts to public Telegram Bot API or Slack webhooks, indicative of potential data exfiltration by the npm indexed-btree malware or similar malicious actors utilizing these services for command and control or exfiltration.
Detects potential Command and Control (C2) beaconing activity associated with Xray-core, where the TLS Server Name Indication (SNI) field is spoofed to 'dl.google.com' to masquerade malicious traffic as legitimate Google-related traffic.
Detects network activity associated with a malicious npm package campaign leveraging Sepolia Ethereum testnet RPC endpoints (Alchemy and Infura) for command-and-control (C2) communication. The detection looks for JSON-RPC 'eth_call' requests and specific contract address references characteristic of this campaign.
Detects anomalous SharePoint search activity that uses 'indexdocid' queries targeting specific site or web content classes. This pattern is often indicative of automated reconnaissance or enumeration of documents within a SharePoint environment, potentially attempting to bypass standard UI navigation to identify or access sensitive content.
Page 359 of 1168