Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects phishing emails attempting to impersonate executive roles (CEO, CFO, President) or using ServiceNow-themed lures (invoices, approvals) to solicit unauthorized ACH or wire transfers. The detection logic focuses on suspicious sender domains, payment-related keywords, and executive-specific titles in the email body.
This rule detects non-interactive authentication attempts to key development and collaboration platforms (e.g., GitHub, GitLab, Slack, Azure DevOps) from IP addresses or locations that have not been observed in the user's interactive sign-in history over the past 14 days. This behavior is indicative of potential session or refresh token theft, where an adversary replays stolen browser cookies from a different infrastructure to bypass traditional authentication.
No description available.
No description available.
Detects User Account Control (UAC) bypass attempts where an adversary writes to specific registry keys under HKCU\Software\Classes to hijack COM handlers, followed shortly by the execution of auto-elevating Windows binaries like fodhelper.exe, computerdefaults.exe, or sdclt.exe. This activity facilitates silent privilege escalation.
Detects Python compiled bytecode (.pyc) files that have been renamed to .cat, a common Windows Security Catalog extension. This is a masquerading technique often used by backdoors to evade detection and facilitate malicious loader execution.
Detects outbound network traffic and subsequent inbound responses associated with AsyncRAT command and control (C2) communication. This rule monitors connections directed toward a specific hardcoded IP address known to be associated with AsyncRAT activity.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects a classic process injection technique where an external process attempts to gain high-level access (OpenProcess with 0x1F0FFF) to charmap.exe. This activity is often a precursor to further injection steps such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, a behavior consistent with malicious payloads like AsyncRAT executed via an abused AutoIT interpreter.
Detects the execution of processes named 'UpdateAssistant.exe', 'AppUpdateHelper.exe', or 'SysMaintenance.exe' from specific common application directories that are either unsigned or lack a valid Microsoft digital signature. This pattern is commonly used by adversaries to masquerade malicious binaries as legitimate system update components to evade detection.
Page 428 of 1168