Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects PowerShell script execution that interacts with the GitHub API, specifically targeting the upload of files or JSON data to repository endpoints. The logic looks for commands related to file system access, inclusion of 'api.github.com', and references to 'SmartUploader' or 'uploaded_files.json'. It further filters for activity occurring within standard user directories and enforces a check to ensure the GitHub repository name matches the local hostname, which is a common indicator of automated exfiltration scripts.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects the creation of a suspicious file named 'FitnessMonitor.exe' within the Windows Startup folder. This technique is commonly used by remote access trojans (RATs) to ensure persistent execution upon user logon.
This rule monitors Microsoft Graph API audit events to detect potentially malicious reconnaissance or enumeration activity. It identifies actors who access a diverse range of resource categories (such as directory, tenant, privilege, application, repository, and mailbox) within a short 30-minute window, suggesting automated discovery or unauthorized data mapping rather than standard administrative tasks.
Detects DNS, TLS SNI, and HTTP Host header requests to known phishing domains mimicking Passkey or Single Sign-On (SSO) authentication services. These domains attempt to deceive users into providing credentials or performing unauthorized authentication actions.
Detects modifications to Active Directory user accounts (Event IDs 4720, 4738) that coincide with suspicious MFA registration indicators—such as increased device counts, software token activations, or default device/token placeholders—within one hour of a successful user authentication event. This behavior is indicative of potential account takeover or persistence activities involving MFA manipulation.
Detects network activity associated with the SilverFox multi-tier relay infrastructure, specifically identifying HTTP requests to known relay domains and dispatcher endpoints used for command-and-control (C2) communication.
This rule detects potential unauthorized access to the 'My Sign-Ins' portal in Azure AD by monitoring for logins associated with multiple unique source IP addresses or Autonomous System Numbers (ASNs) for a single user account. This behavior is indicative of session hijacking or account compromise where an adversary is accessing the account from a different network than the legitimate user.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
Detects host-based network reconnaissance behaviors commonly associated with the threat group APT36 (Transparent Tribe). The rule identifies the execution of various built-in Windows network discovery commands including arp, nbtstat, net view/share/session, and automated ping sweeps or PowerShell-based subnet enumeration scripts, which are used to map reachable hosts and network shares.
Page 426 of 1168