Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects npm package publishing events performed via GitHub Actions OIDC trusted publishing that occur without the use of a traditional npm token. This rule targets potentially unauthorized package releases triggered by automated CI/CD identities, which may indicate abuse of compromised workflows or misconfigured auto-publish settings.
Detects network indicators associated with the ClearFake campaign, including connections to known dead-drop resolvers (bsc-testnet-rpc.publicnode.com), use of Cloudflare Workers as C2 infrastructure, and the delivery of malicious fake browser-update/CAPTCHA JavaScript payloads.
Detects the deletion of suspicious files associated with macOS malware families commonly referred to as FLATROOF or ROOFDECK. The rule monitors for the removal of files located in specific directories ('com.apple.iTunesCloud/SystemUpdate' or 'com.apple.internal.ck/iSync') using system utilities like 'rm' or via the 'loginwindow' process, which is indicative of malware attempting to clean its tracks after execution or persistence.
This rule detects forced pushes to the main branch of a GitHub repository where a specific file named 'indexe.cjs' is added or a specific commit ID (d1d55e13) is pushed. This behavior is indicative of a supply chain compromise where an attacker rewrites git history to inject malicious loaders or backdoors into the source code.
Detects GitHub push events where the actor pushing the changes does not match the commit author or committer identities, and the commit is not cryptographically signed. This pattern may indicate credential theft or account compromise where an adversary is pushing code using stolen credentials or impersonating authorized users.
Detects unusual network connections over port 445 involving SMB named pipes commonly associated with lateral movement tools or P2P beaconing. The rule identifies communication through suspicious or generic pipe naming conventions that deviate from standard system process behavior (e.g., lsass, services, svchost, System).
Detects the loading of amsi.dll by common .NET loader processes, which may indicate attempts to patch or bypass the Antimalware Scan Interface (AMSI) in memory. The rule monitors for image load events of amsi.dll and correlates them with process creation events of known loaders such as powershell.exe, rundll32.exe, and others.
Detects processes attempting to load ntdll.dll or utilizing DLLs in a manner that may indicate the use of indirect syscalls, a technique used by malware to bypass EDR/AV user-mode API hooking.
This rule detects potential PIVOTPIPE activity by correlating AMSI patching indicators with anomalous memory protection changes. It identifies processes that perform frequent transitions to PAGE_EXECUTE_READWRITE or PAGE_NOACCESS, which is indicative of memory-based obfuscation techniques used to evade memory scanning and detection during sleep cycles.
Detects outbound HTTP requests where the user-agent starts with 'PHP/' and the URI contains the path for the Admin Menu Editor Pro plugin, suggesting communication between a trojanized WordPress plugin and a remote command-and-control server.
Page 401 of 1168