Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,562 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential web shell activity on Microsoft Exchange servers by identifying suspicious processes (like cmd.exe, powershell.exe) spawned by w3wp.exe (IIS worker process) that are associated with the creation or modification of common web shell file extensions (.aspx, .ashx, .asax) within critical Exchange server directories.
This rule monitors for execution patterns associated with the Evil-WinRM tool, a common post-exploitation framework used for remote command execution via WinRM. It identifies suspicious command-line arguments in PowerShell, the creation of configuration files typical of the tool, and network connections to WinRM ports initiated by common execution binaries like PowerShell or Ruby.
Detects high-frequency execution of Python interpreter processes within a short timeframe (40+ distinct command lines in 15 minutes). This behavioral pattern is indicative of automated or autonomous agent-driven payload delivery and execution, as seen in JADEPUFFER and ENCFORGE campaigns.
This rule detects attempts to exploit Apache Nacos vulnerabilities, including authentication bypass and unauthorized administrative account creation. It monitors process executions of common tools (like curl and java) and network connections targeting known Nacos service ports (8848, 9848) containing indicators of exploit patterns such as login bypass endpoints or SQL injection sequences targeting the user table.
This rule detects suspicious child processes, such as shells and system utilities, spawned by PaperCut application processes (pc-app.exe, pc-app-service.exe) or associated Java/Tomcat service components. This pattern is commonly observed during exploitation attempts targeting PaperCut Print Management software, where attackers use web services to gain command execution.
Detects potential web shell or malicious DLL deployment into Microsoft Exchange or IIS directories by the IIS worker process (w3wp.exe), as well as suspicious child process execution (such as command-line shells or credential discovery tools) spawned directly from IIS worker processes.
Detects the presence of natural-language self-narration in code comments within Python or SQL scripts. This pattern is indicative of LLM-driven agentic execution, where automated agents narrate their own malicious actions, such as enumeration, data exfiltration, or database manipulation, as observed in the JADEPUFFER campaign.
Detects the execution of MySQL process command lines that simultaneously contain the strings 'AES_ENCRYPT' and 'UPDATE'. This pattern often indicates attempts to manipulate data within the database via SQL injection or unauthorized database modification.
Detects potential SQL injection attempts by monitoring for 'INSERT INTO' SQL commands executed via command-line arguments. The rule specifically looks for operations targeting user or role tables and including administrative keywords, originating from database or application-related processes like mysql or java.
Detects when ScreenConnect client processes (ClientService.exe or WindowsClient.exe) spawn child processes that are not part of the standard ScreenConnect application suite. This behavior is indicative of unauthorized use of remote access tools for command execution or lateral movement.
Page 467 of 1168