Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,552 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the Rubeus toolset with command-line arguments indicative of Kerberos ticket abuse, including Kerberoasting, AS-REP Roasting, and Pass-the-Ticket (PTT) techniques. These methods are commonly used by adversaries for credential harvesting and facilitating lateral movement within an Active Directory environment.
Detects HTTP GET requests to a specific path structure /scanna/ which includes a token-like identifier and a check=1 parameter. This pattern is indicative of a bot-filtering relay mechanism often used by malicious scripts or malware to validate or redirect traffic while attempting to evade security scanners.
Detects high-velocity retrieval of multiple secrets from AWS Secrets Manager using a single IAM role or session shortly after activity initiation. This behavior is indicative of automated credential harvesting, often occurring post-compromise of a host (e.g., an SSH bastion) that has been assigned a high-privilege IAM role.
Detects when a single process terminates two or more critical security, database, or backup related processes within a short window. This behavior is often associated with adversary attempts to disable security controls or disrupt database operations, commonly observed during the impact phase of an attack or preparatory to data destruction/encryption.
Detects DragonForce ransomware attempting to identify accessible SMB network shares by executing 'net view' commands. This activity is a precursor to encrypting files on reachable administrative shares (e.g., C$) while excluding system-specific shares like ADMIN$.
Detects access to sensitive cryptocurrency wallet files (wallet.dat, seed phrases, keys) or the execution of Python processes from sensitive or commonly exploited directories (AppData, tmp, Public folders) associated with known malicious naming conventions (sys_service).
This rule detects network activity associated with known command-and-control (C2) infrastructure. It monitors for connections to specific malicious domains, IP addresses, or URI paths combined with unique HTTP headers or request body markers indicative of C2 beacons or data exfiltration.
This rule detects the execution of processes that contain the command line argument 'Found sid:', which is commonly associated with security identifier (SID) enumeration or lookup tools/scripts, such as those used by security researchers or attackers during reconnaissance.
Detects the use of native Windows tools like vssadmin and wmic to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks attempting to inhibit system recovery.
Detects modifications to the Windows Registry subkeys associated with the 'ms-settings' URI scheme, which are targeted by the 'fodhelper.exe' UAC bypass technique. The rule correlates registry operations in HKCU with the execution of fodhelper.exe to identify attempts to elevate privileges without triggering a UAC prompt.
Page 394 of 1168