Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,310 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Detects instances where a user performs high-risk sign-in activities (such as impossible travel or triggered risk events) followed by the registration of new security information, MFA methods, or rogue OAuth devices within a 30-minute window. This behavior is indicative of an attacker establishing persistence on a compromised account by bypassing or hardening MFA requirements.
Detects a multi-stage activity chain indicative of infostealer malware, including reading the browser 'Local State' file (containing the master key), accessing a browser process (likely for memory dumping or token extraction), and initiating an immediate outbound network connection to an external destination.
Detects unauthorized access to common browser credential storage files (Login Data, Cookies, Web Data, Local State) by processes other than standard web browsers. This rule identifies potentially malicious activity by filtering for rare or unsigned binaries executing from common staging directories (Temp, Downloads) or accessing browser files shortly after the process launch, which is a common behavior pattern for info-stealer malware.
Detects impossible travel authentication patterns where a user logs in from two geographically distant locations within a short time frame, while specifically filtering for sessions that reuse existing refresh or session tokens instead of performing fresh interactive authentication.
Detects potential account compromise by aggregating multiple high-fidelity indicators of adversary activity for a single user within a 72-hour window. The rule triggers when at least three distinct stages of an attack chain are identified, specifically: credential theft/infostealer activity, anomalous sign-in (token reuse/impossible travel), mailbox or OAuth configuration changes, and mass data exfiltration.
Detects the modification of Microsoft IIS configuration to disable HTTP logging using the appcmd.exe utility. This technique is often used by adversaries to impair security monitoring and evade detection after compromising a web server.
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
Detects the execution of PowerShell with suspicious command-line patterns indicative of obfuscation or malicious intent, including encoded commands, Base64 decoding, IEX combined with common download cmdlets, and specific obfuscation techniques like backtick concatenation, character casting, or variable concatenation.
Detects the abuse of the Windows Background Intelligent Transfer Service (BITS) via the bitsadmin command-line tool or PowerShell's Start-BitsTransfer to download files (such as .exe, .dll, or .ps1) or facilitate potential persistence. Adversaries use these methods to transfer malicious payloads stealthily in the background or to maintain persistence on a compromised host.
Page 47 of 1168