Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors successful user sign-ins using the 'deviceCode' authentication protocol that originate from an IP address previously unseen for that specific user within the last 24 hours. The Device Code flow is commonly targeted in phishing campaigns to bypass traditional credential-based MFA, making anomalous logins using this protocol a high-signal indicator of account compromise.
Detects sustained outbound TCP communication patterns indicative of Xray-core proxy or tunneling activity. The rule monitors for high-frequency established TCP sessions originating from the internal network, which is a common behavior for tools used to maintain persistent network tunnels or proxy command-and-control traffic.
Detects instances where the RemoteApp Gateway broker process (wkspbroker.exe) loads the 'radcui.dll' module from the 'AppData\Local\Microsoft\RemoteApp\Gateway' directory. This behavior, especially when accompanied by configuration artifacts like 'config.json' or 'comsrv.dat' in the same path, is indicative of potential DLL side-loading or application hijacking, as these components are typically expected to reside in system-protected directories rather than user-writable local paths.
Detects the execution of a specific batch file named 'KB85809588.bat', either directly or via the Windows Command Shell (cmd.exe) and Console Host (conhost.exe). This pattern is often indicative of malicious scripts or automated tasks executed as part of an attack chain.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects network activity initiated by Node.js processes towards specific Infura and Alchemy RPC endpoints for the Sepolia testnet, including specific JSON-RPC queries containing potential malicious contract addresses. This pattern is indicative of C2 communication using legitimate Web3 infrastructure.
This rule detects network traffic originating from internal hosts to Slack's domain that contains hardcoded Slack bot tokens and specific Slack channel IDs associated with a malicious npm supply chain campaign (indexed-btree). This indicates successful exfiltration of sensitive configuration credentials or data to an attacker-controlled Slack environment.
Detects the loading of radcui.dll by the WkspBroker.exe process when the DLL is located within a path associated with Microsoft RemoteApp Gateway, which is often indicative of DLL sideloading or execution hijacking of a legitimate process.
Page 403 of 1168