Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,557 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
This rule detects rapid, repetitive TCP connection attempts to port 445 (SMB) originating from a single source within a 30-second window. Such activity is indicative of automated network scanning and enumeration, often used for discovery of vulnerable SMB shares or lateral movement preparation.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects anomalous activity where a user performs a device-code authentication followed rapidly by a device registration event and the subsequent issuance of a Primary Refresh Token (PRT) or x-ms-RefreshTokenCredential. This pattern is often indicative of OAuth device-authorization flow abuse, where an adversary attempts to register a malicious device to gain persistent access.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
Page 452 of 1168