Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,556 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to perform a DCSync attack by monitoring for Windows Event ID 4662 where sensitive Directory Replication Service (DRS) rights are requested. This attack pattern, often associated with tools like Mimikatz, allows an adversary to pull password data from Active Directory. The rule excludes requests from known domain controller accounts.
Detects pre-encryption defensive measures employed by the Monkey ransomware C++ variant. This rule triggers on behaviors including Microsoft Defender exclusion management, disabling of AMSI or ETW components, manipulation of system security settings via registry, and attempts to clear PowerShell or command-line history to facilitate anti-forensic evasion.
This rule detects a sequence of events where a database user record is updated (inserting a new password hash) followed by a successful authentication for that same user, immediately following a recent login failure. This pattern is indicative of an attacker modifying credentials and then testing the new access.
Detects anomalous authentication or API access patterns where a single user account interacts with both Salesforce and ServiceNow environments simultaneously from multiple distinct source IP addresses. This behavior is indicative of credential abuse or account takeovers consistent with multi-platform SaaS targeting.
This rule monitors IT asset inventory data for instances of ConnectWise (ScreenConnect) software running outdated versions prior to 26.6.5, which are known to be vulnerable to CVE-2026-84869. Identifying these assets is critical for preventing potential exploitation of public-facing remote administration tools.
Detects unauthenticated network requests targeting specific administration endpoints (SetupCompleted, configure-update-service, or /admin/) of PaperCut NG/MF applications. The rule identifies potential exploitation attempts by flagging successful requests that return HTTP status codes other than 401 (Unauthorized) or 403 (Forbidden), indicating a possible authentication bypass.
Detects anomalous post-exploitation behaviors such as mass file modifications, lateral movement (SMB/RDP), or persistence mechanisms (scheduled tasks/services) following ScreenConnect client session activity. This behavior is indicative of potential exploitation of ScreenConnect to deploy ransomware or move laterally within the network.
Detects evidence of CRPx0 ClickFix ransomware execution by monitoring the HKCU RunMRU registry key for patterns indicating the execution of obfuscated or malicious commands (PowerShell, curl, or base64 encoded strings) consistent with clipboard-hijacking social engineering campaigns.
Detects the installation of a potentially malicious root certificate on a host. The rule monitors for common command-line arguments used by 'certutil.exe' to add certificates to the store, use of the 'security' utility for certificate installation on macOS, and the execution of processes referencing 'Localcertificate.zip'.
Detects evidence of anti-forensic activities associated with the SparroWocky toolset. The rule monitors for the removal of the 'ProcAuditManager' service, deletion of the 'SnapCart' registry key, and the execution of a self-deleting batch script used to remove forensic artifacts.
Page 437 of 1168