Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to the 'InProcServer32' registry key within HKCU\Software\Classes\CLSID. This activity, which involves pointing a CLSID to a library file located in non-standard user-writable directories (like AppData), is a common technique for COM object hijacking used to achieve persistence or code execution.
Detects high-frequency search queries in SharePoint that utilize internal document identifiers (indexdocid), which may indicate an adversary attempting to enumerate or scrape content across a site collection.
Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects the use of the wevtutil.exe utility to clear the Microsoft-Windows-Defender/Operational event log, a technique used by adversaries to disrupt security monitoring and hide malicious activity.
Detects the use of the wevtutil.exe utility to clear the Microsoft-Windows-Defender/Operational event log, a technique used by adversaries to disrupt security monitoring and hide malicious activity.
Detects the creation of .lnk files within the user startup directory. The rule flags suspicious activity by monitoring for specific file names often associated with the StealC information stealer, or when these files are created by common scripting hosts like PowerShell, WScript, or CScript.
Detects anomalous remote access or VPN login activity for a user account, characterized by either logins from multiple distinct countries or logins occurring during off-hours (between 8:01 PM and 5:59 AM). This rule helps identify potential credential abuse where valid accounts are being leveraged from unexpected locations or times.
This rule detects attempts to clear Windows Event Logs using the 'wevtutil.exe' command-line utility or by identifying the generated Windows Security Event ID 1102 (Audit log was cleared). It tracks multiple instances of log clearing to identify suspicious bulk log deletion activity.
Detects execution of the Windows diskpart utility using a script file, initiated by a process with a name ending in _win64.exe. This pattern is commonly used in malicious scripts for disk manipulation or inhibiting system recovery.
Page 404 of 1168