Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,562 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by monitoring specific Azure AD sign-in failure codes (50074: strong authentication is required, 50140: interruption of sign-in) in conjunction with logins from unmanaged devices.
This rule detects high-volume interactions with the Exchange Online REST API originated from the 'One Outlook Web' application ID, specifically filtering for events with associated token IDs. This pattern may indicate automated mailbox data exfiltration or unauthorized bulk email access, which has been observed in recent phishing-based identity compromise campaigns.
Detects local privilege escalation attempts targeting Acronis backup plugins for cPanel, WHM, and Plesk. The rule monitors for instances where backup-related processes or binaries located within control panel paths are executed with root privileges when the parent process was not originated by root, a behavior indicative of exploiting insecure file permissions.
Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.
Detects the execution of a shell process (sh, bash, dash, zsh) spawned as a child of Acronis backup agent or plugin processes by the root user. This behavior is indicative of potential exploitation of local privilege escalation vulnerabilities, such as CVE-2026-87886, within Acronis backup plugins for cPanel, WHM, and Plesk.
Detects instances where web server worker processes such as php-fpm, apache, or nginx spawn shell interpreters (sh, bash, dash). This behavior is often indicative of web shell execution, where an adversary leverages a compromised web application to execute arbitrary commands on the underlying host.
Detects repeated process execution events associated with Acronis backup plugins for cPanel, WHM, or Plesk within a 15-minute window. This behavior is consistent with automated exploitation attempts, specifically referencing CVE-2026-87886, which target these backup management plugins to achieve privilege escalation or unauthorized system access.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.
Page 459 of 1168