Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,562 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where PowerShell.exe is launched directly from the Windows Run dialog (explorer.exe as parent) with command-line arguments indicative of a ClickFix/ClearFake social engineering attack. This typically involves the user pasting malicious code, which often includes references to WebDAV UNC paths or external domains used for malicious delivery, into the Run dialog.
This rule detects outgoing HTTP POST requests to the public BSC testnet RPC endpoint ('bsc-testnet-rpc.publicnode.com') containing an 'eth_call' request, which is a technique used by the 'EtherHiding' campaign to fetch malicious JavaScript payloads directly from blockchain smart contracts, bypassing traditional web-based C2 infrastructure.
Detects network traffic attempting to download malicious PowerShell payloads via WebDAV from the domain leaguejazire.com, which is associated with the ClearFake malware campaign.
Detects Git force-push events or protected branch policy overrides on main or master branches where the authenticated GitHub user differs from the commit author or committer, and the commit is unsigned. This pattern is indicative of credential abuse or account compromise where an attacker pushes unauthorized code while masquerading as a project maintainer.
Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.
Detects the modification of a GitHub Actions release workflow that removes manual approval/gate requirements and introduces a push-to-main trigger, followed closely by an automated npm publish event. This behavior suggests an attempt to establish an unattended supply chain release path.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
Detects instances where an executable file (exe, dll, js, cjs) deletes itself within 30 seconds of execution. This is a common technique used by malware to remove its installation artifact after spawning a persistent process or to evade signature-based detection.
Detects the execution of known potentially malicious or unauthorized tools, specifically 'client32.exe' and variations of 'hypersnap.exe'. These binaries may be used by attackers for remote access, surveillance, or unauthorized data capture.
Detects the execution of PowerShell commands that attempt to retrieve hardware and OS-level system information using WMI queries or API-like indicators commonly used by reconnaissance tools.
Page 460 of 1168