Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where browser extensions interact with specific AI-driven websites (Gemini, Perplexity, Claude) in a manner that bypasses user input or interacts with hidden DOM elements. This pattern is indicative of malicious browser extensions injecting scripts or manipulating content in the background without explicit user authorization, potentially for data exfiltration or automated session interaction.
Detects browser-based network requests to 'script.google.com'. This can indicate usage of Google Apps Scripts, which are sometimes abused by attackers for Command and Control (C2) infrastructure, data exfiltration, or as a proxy for malicious payloads, by blending in with legitimate Google traffic.
This rule detects the installation or operation of browser extensions that request overly broad host permissions (e.g., all URLs) or specifically target popular AI services (like Gemini, Copilot, or Claude). It also monitors the use of the declarativeNetRequest API to interact with these same AI service domains, which is a technique used by malicious extensions to intercept or manipulate web traffic.
Detects the installation or configuration of a browser extension that combines 'declarativeNetRequest' (network manipulation) and 'content_scripts' (DOM injection) capabilities while targeting sensitive AI-assistant domains such as gemini.google.com, perplexity.ai, opera.com, or claude.ai. This configuration is indicative of potential AI agent hijacking, allowing unauthorized code execution and traffic interception on trusted vendor websites.
This rule detects the presence of the Amatera (ACR Stealer) loader by identifying characteristic indicators, including specific Telegra.ph dead-drop URLs, domain-fronting artifacts using github.com, and hardcoded C2 IP addresses. It also identifies credential theft targeting by searching for artifacts related to password managers such as KeePass, Bitwarden, WinAuth, and Authy, combined with the presence of C2 communication indicators.
Detects instances where rundll32.exe is used to execute a DLL file directly from a remote WebDAV-mounted network path (indicated by the 'DavWWWRoot' string). This technique allows for the execution of arbitrary code without writing the malicious payload to the local disk, a common tactic seen in fileless malware delivery and campaigns like ClearFake.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
Detects execution of known malicious files that subsequently interact with temporary directory debug logs and establish network listening sockets within a short timeframe. This behavior pattern is characteristic of post-exploitation activity, specifically the staging and operation of listener modules.
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
This rule detects malicious network traffic generated by the ClearFake malware, which uses a specific JSON-RPC 'eth_call' request to the Binance Smart Chain (BSC) testnet to retrieve C2 instructions from a designated dead-drop smart contract. This method allows the adversary to maintain persistent command and control communication by leveraging blockchain technology.
Page 400 of 1168