Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation, modification, or renaming of files that contain sensitive keywords (e.g., 'password', 'seed', 'wallet', 'recovery') by processes other than standard system or productivity applications. This activity is indicative of credential or sensitive data harvesting.
Detects specific administrative actions within Entra ID/Azure AD, including directory role assignments, password resets, and account enablement/disablement. This rule monitors for sensitive identity lifecycle and privilege management events that, if performed by unauthorized actors or in an unexpected context, could indicate account compromise, persistence, or privilege escalation.
Detects the creation of a new Windows service using the service control manager command-line utility (sc.exe). This command is commonly used by attackers to achieve persistence by creating services that execute malicious binaries at startup, or to run processes with SYSTEM privileges.
This rule detects the execution of the legacy finger.exe utility when spawned by common user-facing applications (e.g., browsers, shells, explorer). The detection specifically looks for instances where the command line includes an '@' character, indicating an attempt to query information from a remote host, while excluding standard localhost queries. This pattern is often associated with reconnaissance activity or enumeration of remote users/systems.
Detects instances where a process that is not a known PowerShell host (powershell.exe, pwsh.exe, powershell_ise.exe) loads the System.Management.Automation.dll assembly, which is a strong indicator of an attempt to execute PowerShell code within a different process to evade detection.
Detects the invocation of common command-line interpreters (PowerShell or Windows Command Shell) via process creation events. This is a broad detection for administrative shell activity, which may also indicate malicious script execution or manual adversary interaction.
Detects instances where the device code authentication protocol is utilized. This protocol is commonly used for headless devices, but is also frequently abused by adversaries for phishing and device code flow abuse to acquire unauthorized access tokens.
Detects the loading of the kernel driver 'Alinubx.sys', identified as a renamed instance of the 'CcProtect.sys' driver. This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, specifically observed in the context of Rapuncel infostealer campaigns.
Detects Microsoft Intune MDM enrollment events occurring shortly after an OAuth 2.0 device code authentication for the same user. This pattern is indicative of an adversary using stolen OAuth tokens or Primary Refresh Tokens (PRT) to perform rogue MDM enrollment, a technique used to maintain persistence and bypass standard security controls such as password resets.
Detects Bird Agent malware samples that exhibit characteristic behavior of binding configuration decryption to the Windows MachineGuid registry value. The rule identifies binaries that contain references to 'config.toml' and the Windows Cryptography registry key used to retrieve the MachineGuid, often used as a unique machine-based key for decryption.
Page 411 of 1168