Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,557 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
Detects the creation or modification of scheduled tasks (cron jobs) located within web application log directories (e.g., JBoss, Tomcat, Wildfly) that exhibit behavior consistent with malicious file reinjection. This rule correlates suspicious cron activity with recurring modifications to sensitive web files (e.g., JS bundles, checkout pages), indicating persistent skimmer activity that survives redeployment.
Detects anomalous database activity involving the creation of 'ZQ'-prefixed staging tables followed by a high-volume drop operation across multiple tables within a short timeframe. This behavior is indicative of data staging for potential exfiltration followed by an attempt to delete evidence or clear tracks.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that involve indicators often associated with malicious behavior, such as targeting temporary or publicly writable directories ('appdata', 'temp', 'programdata') or employing suspicious command-line flags (e.g., encoded commands, highest privileges, or execution on system startup).
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable system recovery features. The rule further correlates this activity with preceding mass file activity to identify potential ransomware or destructive attack behavior.
Detects potential DNS tunneling or Command and Control (C2) communication patterns. The rule calculates subdomain entropy to identify unusually long or randomized subdomain labels, monitors for excessive DNS query volume per client, and flags the use of specific record types (TXT, NULL) often associated with C2 frameworks like dnscat2 or iodine.
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698 that involve suspicious binaries (e.g., powershell, mshta), execution from user-writable directories, or tasks configured to run with SYSTEM privileges, which are common indicators of persistence establishment.
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks by identifying an initial legitimate sign-in followed by a second sign-in from a different IP address within a short timeframe (indicative of session token replay), immediately succeeded by high-risk post-compromise actions such as OAuth application consent or the creation of malicious mailbox rules.
Page 441 of 1168