Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,299 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where explorer.exe (the Windows Shell) launches common scripting or command-line binaries with suspicious arguments often associated with 'ClickFix' social engineering attacks. These attacks involve tricking users into copying and pasting obfuscated PowerShell, mshta, or curl commands into the Windows Run dialog to execute malicious payloads.
Detects potential AI model extraction attacks where an adversary repeatedly queries a private model's inference API. By combining high-volume request counts with high input diversity, the rule identifies behavior indicative of an adversary constructing a labeled dataset to train a substitute, replicated model.
Detects adversarial backdoor triggers (such as pixel patches, watermark-like artifacts, or malicious token sequences) injected into AI inference inputs. The rule identifies these inputs by observing a combination of suspicious trigger patterns and significant, anomalous jumps in prediction confidence directed at a specific target class, indicative of a model integrity compromise.
This rule detects potentially malicious activity related to AI agent tool manipulation. It flags two primary scenarios: 1) The invocation of an AI tool shortly after an unmanaged or potentially unauthorized modification to its definition, and 2) Detection of prompt injection patterns within the output generated by an AI agent tool, which could indicate an attacker attempting to override the agent's instructions.
Detects instances where Microsoft Office applications or Windows Explorer (via LNK file execution) spawn suspicious child processes, such as script interpreters or known LOLBins, within a short timeframe. This is a common pattern for initial access via spearphishing attachments where a malicious document or shortcut executes a payload.
This rule detects successful authentication events for remote access applications (VPN, RDP, Azure AD App Proxy) where the source IP address or ASN has not been observed in the user's login history within the preceding 14 days. This behavior is indicative of potential account takeover using compromised credentials sourced from infostealers or other credential-harvesting activities.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell cmdlets that execute with SYSTEM privileges, or tasks that reference common temporary directories or persistence triggers (logon, idle). This behavior is frequently associated with ransomware, malware persistence, or staged payload execution.
Detects a suspicious burst of commands commonly used to disable security services, antivirus, or backup agents on a single host. The rule monitors for a high frequency of taskkill, net stop, sc stop, or PowerShell Stop-Service operations targeting a predefined list of sensitive security software process and service names within a short timeframe, which is a common precursor to ransomware encryption.
Detects account modification activity (e.g., password resets or MFA registration changes) followed within 24 hours by a sign-in event for the same user account that is flagged as risky or exhibits anomalous device/location characteristics, indicative of social engineering campaigns like Scattered Spider.
Detects the creation of scheduled tasks using 'schtasks.exe' or 'Register-ScheduledTask' where the task command path is located in suspicious directories such as AppData, Temp, or ProgramData, or where the task is configured to run under the SYSTEM account. This behavior is commonly used by adversaries for persistence.
Page 38 of 1168