Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,293 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.
Detects suspicious child processes such as shell interpreters, download utilities, and base64-decoded commands spawned from core Citrix NetScaler processes (nsppe, httpd, aoacli, nscli). This pattern is often indicative of post-exploitation command execution following an exploitation of remote code execution (RCE) vulnerabilities.
Detects instances where a user account consents to an OAuth application requesting high-privilege or sensitive scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This behavior is a common indicator of consent phishing attacks, where adversaries trick users into granting persistent access to their cloud resources via malicious OAuth applications.
Detects the use of legitimate Windows administrative tools (vssadmin, wmic, wbadmin, bcdedit, sc, net) to delete volume shadow copies, clear backup catalogs, disable boot recovery options, or stop critical backup and system services. This behavior is highly characteristic of ransomware activity aiming to prevent data restoration and system recovery.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects instances where explorer.exe (the Windows Shell) launches common scripting or command-line binaries with suspicious arguments often associated with 'ClickFix' social engineering attacks. These attacks involve tricking users into copying and pasting obfuscated PowerShell, mshta, or curl commands into the Windows Run dialog to execute malicious payloads.
Detects potential AI model extraction attacks where an adversary repeatedly queries a private model's inference API. By combining high-volume request counts with high input diversity, the rule identifies behavior indicative of an adversary constructing a labeled dataset to train a substitute, replicated model.
Detects adversarial backdoor triggers (such as pixel patches, watermark-like artifacts, or malicious token sequences) injected into AI inference inputs. The rule identifies these inputs by observing a combination of suspicious trigger patterns and significant, anomalous jumps in prediction confidence directed at a specific target class, indicative of a model integrity compromise.
This rule detects potentially malicious activity related to AI agent tool manipulation. It flags two primary scenarios: 1) The invocation of an AI tool shortly after an unmanaged or potentially unauthorized modification to its definition, and 2) Detection of prompt injection patterns within the output generated by an AI agent tool, which could indicate an attacker attempting to override the agent's instructions.
Detects instances where Microsoft Office applications or Windows Explorer (via LNK file execution) spawn suspicious child processes, such as script interpreters or known LOLBins, within a short timeframe. This is a common pattern for initial access via spearphishing attachments where a malicious document or shortcut executes a payload.
Page 36 of 1168