Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of Mimikatz or the use of specific Mimikatz command-line arguments intended to extract credentials from LSASS memory, a common technique for credential harvesting during post-exploitation activities.
Detects unauthorized file write operations performed by ScreenConnect client or service processes into client/transfer directories. This activity is indicative of exploitation attempts, specifically CVE-2026-84869, which allows for unauthorized file transfers and potential remote code execution via active ScreenConnect sessions without user confirmation.
Detects an attempt to exploit CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies POST requests to the '/api/v1/validate/code' endpoint that contain base64 encoded strings in the request body, which are characteristic of malicious Python payloads designed to execute arbitrary code.
Detects high-volume, sequential HTTP requests directed at sensitive PaperCut NG/MF web interfaces from a single source IP address within a one-hour window. The high frequency of unique target access suggests automated scanning or exploitation attempts (consistent with CVE-2026-81578/CVE-2026-82078) typical of AI-driven or scripted attack campaigns.
Detects instances where a service principal or entity identified as an AI agent, bot, or assistant accesses files in SharePoint or OneDrive that are likely to contain sensitive credentials, secrets, or configuration files (e.g., .pem, .pfx, .env, id_rsa).
Detects high-volume, systematic API requests to AI inference endpoints from a single user ID, which may indicate automated model extraction or scraping attacks against AI services.
Detects anomalous AWS STS GetCallerIdentity activity characterized by multiple failed authentication attempts (InvalidClientTokenId, SignatureDoesNotMatch, AccessDenied, AuthFailure, InvalidAccessKeyId). This pattern is consistent with an adversary performing bulk validation of stolen or harvested AWS IAM access keys to identify valid credentials.
Detects a pattern where a single source IP address performs multiple successful authentications across different cloud account identifiers within a short timeframe. This behavior is indicative of automated credential spraying, multi-agent automated access, or potential account takeover activity targeting multiple accounts within a cloud environment.
Detects the execution of PowerShell commands that utilize both obfuscation techniques (such as Base64 encoding or 'FromBase64String') and remote payload retrieval or memory execution methods (such as 'IEX', 'DownloadString', or 'Invoke-WebRequest'). This combination is a classic indicator of malicious PowerShell activity designed to download and execute second-stage payloads.
This rule detects the creation, modification, or renaming of a browser extension's 'manifest.json' file, which is a critical configuration file for browser extensions. It correlates this file activity with simultaneous or subsequent network requests to common web-based productivity or email services (e.g., Google, Microsoft, Perplexity). This combination of file modification in an extension directory and network activity to sensitive domains may indicate the installation of a malicious browser extension designed for session hijacking or unauthorized data collection.
Page 469 of 1168