Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where permissions related to file transfers are granted or accessed within a ScreenConnect remote access session. This rule monitors for session-related events or permission updates that could indicate an attacker leveraging the remote access tool to exfiltrate data or interact with the filesystem.
Detects the execution of the Rubeus tool, a C# toolkit used for interacting with the Kerberos protocol. The rule specifically monitors command-line arguments and process names associated with common Kerberos exploitation tasks such as Kerberoasting, Golden/Silver Ticket forging, and ticket manipulation.
Detects file creation, modification, or renaming events initiated by ScreenConnect (ClientService.exe or WindowsClient.exe) that are not accompanied by associated user confirmation, consent, or file transfer events. This can indicate an unauthorized or silent file manipulation by a remote actor using the ScreenConnect tool.
Detects multiple defense evasion techniques typically associated with the Monkey ransomware family, including clearing Windows Event Logs, clearing PowerShell command history, tampering with AMSI and ETW, modifying Microsoft Defender exclusions, and disabling Task Manager or CMD via registry keys.
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detects potential DCSync attacks by monitoring Windows Security Event ID 4662 for specific Directory Service Replication GUIDs. The rule identifies attempts by unauthorized principals (not domain controllers) to request replication data from the Active Directory domain controller, which is a key indicator of credential harvesting using tools like Mimikatz.
This rule detects potential credential stuffing attempts against a Fortinet FortiGate SSL VPN portal. It triggers when an external source performs multiple HTTP POST requests to the /remote/login endpoint within a short period, accompanied by the FortiGate-specific header, which is indicative of automated brute-force or credential stuffing activity associated with the 'FortiBleed' campaign pattern.
Detects the ENCFORGE locker malware, associated with the JADEPUFFER campaign, which specifically targets AI/ML-related files such as model checkpoints, vector databases, and training data for the purpose of malicious encryption or destruction.
This rule detects file access events targeting sensitive files such as credential stores, configuration files (e.g., .env, config.yaml, wallet.dat), and AWS credential files. This is indicative of an adversary searching for stored secrets or configuration data to facilitate further lateral movement or privilege escalation. The rule excludes common developer tools like code editors and file explorers to reduce noise.
This rule detects the execution of the Rubeus tool, a known C# toolkit for raw Kerberos interaction. The rule specifically alerts on command-line arguments associated with common Kerberos attacks such as Kerberoasting, requesting TGT/TGS tickets, and performing Pass-the-Ticket operations.
Page 435 of 1168