Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,562 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects non-interactive Azure AD sign-in attempts that utilize the device code authentication flow, specifically targeting a Microsoft authentication broker App ID while originating from a Python-requests user agent. This combination is often indicative of automated scripts or malicious tools attempting to bypass standard authentication workflows to gain access to cloud resources.
Detects anomalous device registration behavior where a user account registers multiple unique devices within a very short timeframe (less than 90 seconds). This behavior is characteristic of device code phishing attacks, where an adversary uses automated scripts to rapidly register devices after obtaining authorization codes from victims.
Detects HTML phishing lures associated with the GhostCode kit, which utilizes obfuscation techniques such as zero-font-size <ins> tags and injected HTML comments between characters to bypass static and NLP-based security analysis.
Detects network activity associated with the DarkMe RAT, including DNS lookups for its known C2 domain 'thatawful.boutique' and outbound TCP connections to a hardcoded non-standard port (7712) at a known malicious C2 IP address.
Detects phishing emails impersonating 'Veltrix Capital' that lure developers into running, debugging, or cloning repositories, often disguised as technical assessment or job-related tasks involving cryptocurrency or blockchain themes.
Detects outbound TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused for lateral movement or protocol tunneling of services such as RDP to bypass network ingress filtering.
This rule monitors the Microsoft IIS worker process (w3wp.exe) for the spawning of suspicious child processes often associated with web shell activity, such as command shells (cmd.exe, powershell.exe) or compiler/utility tools (csc.exe, cvtres.exe, rundll32.exe, regsvr32.exe). It further filters for command lines containing Exchange or OWA-related strings, and flags executions containing known web shell indicators (e.g., VIEWSTATE, GhostWebShell, reGeorg).
Detects a large volume of file write, rename, or creation operations within a single minute by a single process, concurrently with the creation of files containing common ransomware keywords (e.g., 'readme', 'decrypt', 'how_to'). This behavior is characteristic of ransomware encryption activities.
This rule monitors command-line activity for common scripting interpreters (Python, PowerShell, Bash, CMD) and flags processes that contain suspicious commentary. It looks for excessive use of comments (3 or more) or specific narrative phrases often found in malicious scripts, such as references to encrypting, dropping, deleting, or escalating privileges, which are indicative of obfuscated or malicious intent.
This rule detects potential scanning activity by identifying high-frequency network connection attempts from a source to multiple distinct internal targets within a short 2-minute time window, specifically targeting suspicious ports (9191, 9192) or a known malicious IP address (45.142.193.132).
Page 465 of 1168