Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,562 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.
Detects the execution of PowerShell with specific command-line arguments (-NonInteractive, -NoProfile, -Command) often used by the Bird Agent backdoor or similar malicious scripts to execute code silently without user intervention or profile configuration.
Detects suspicious child processes (cmd.exe, powershell.exe, java.exe) spawned by the PaperCut NG/MF server processes (pc-app.exe or java.exe), which is indicative of potential post-exploitation activity following remote code execution.
Detects attempts to exploit the Langflow 'validate/code' endpoint, which is associated with CVE-2025-3248. The rule monitors HTTP POST requests to this endpoint for specific character patterns within the request body, indicative of malicious payloads attempting to achieve code execution.
Detects repeated HTTP POST requests containing 'ScreenConnect' in the URI, originating from external networks. This pattern is indicative of automated scanning activity attempting to exploit potential authentication bypass or session hijacking vulnerabilities (such as CVE-2026-84869) in ConnectWise ScreenConnect instances.
Detects the creation of suspicious DLL or ASPX files within Microsoft Exchange or IIS directories that are associated with the GhostContainer backdoor, commonly used by the NightEagle threat actor for maintaining persistence.
Detects potential exploitation attempts against Microsoft Exchange Server, specifically targeting the ECP (Exchange Control Panel) through VIEWSTATE parameter tampering related to CVE-2020-0688, and correlates this with suspicious behavior in the w3wp.exe process, such as unauthorized module loading (e.g., clr.dll, system.web.dll) and abnormal child process creation which may indicate the deployment of in-memory backdoors like GhostContainer.
Detects DCSync activity, a method of credential dumping, by identifying DRSUAPI 'GetNCChanges' replication requests originating from a host that is not a recognized Domain Controller. The rule uses Active Directory replication GUIDs, explicit operation logs, and enriches host data to filter for illegitimate sources.
Detects the deployment of the GhostContainer backdoor, which masquerades as an IIS server component loaded within w3wp.exe. The rule monitors for command-line arguments associated with web shells and known exploitation tools like reGeorg, indicating an attempt to maintain persistence following an Exchange server compromise.
Detects suspicious process execution spawned by ScreenConnect client processes, which may indicate abuse of remote access sessions for arbitrary command execution. This includes both direct child processes of ScreenConnect client binaries and execution of binaries staged within known ScreenConnect working and temporary directories.
Page 468 of 1168