Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects DNS queries originating from internal hosts to subdomains of 'hoster-kg.com' or 'tdtu.org'. These parent domains are identified as hosting C2 infrastructure for various malware families, including SpiceRAT, NodeEdgeRAT, and NomadRAT, and are likely used to facilitate adversary command and control activities.
Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.
Detects anomalous, high-frequency, and highly regular HTTP requests directed at Dahua camera infrastructure for the purpose of harvesting snapshots. The rule uses statistical analysis to identify automated collection patterns, such as a high volume of requests across multiple devices with low variance in request intervals.
Detects HTTP traffic to the Telegram Bot API (/sendPhoto) originating from internal network hosts, which is indicative of potential exfiltration of captured images (e.g., screenshots or webcam captures) to an adversary-controlled Telegram channel.
Detects network traffic (DNS queries, TLS SNI, and HTTP Host headers) targeting the domain 'expresshost.cloud', which is identified as hosting VPS infrastructure commonly used for scanning and malicious activities.
This rule detects the execution of PowerShell from a WScript or CScript parent process where the PowerShell script also performs suspicious actions such as reading environment variables (specifically those following a 'Kv\d+' pattern) and accessing files using 'IO.File::ReadAllText'. This behavior is indicative of malicious scripts, such as those used by specific malware or post-exploitation tools, attempting to retrieve configuration data or credentials stored in environment variables.
Detects outbound RDP-over-TLS traffic directed toward known SilkParasite C2 IP addresses on specific high-numbered ports, or generic RDP-over-TLS patterns on those same non-standard ports, which suggests tunneling or unauthorized remote access.
Detection rules identifying suspicious communication patterns associated with Dahua P2P Cloud Relay devices, including WSSE authentication attempts and device probing to known cloud relay endpoints. These patterns are consistent with reconnaissance and exploitation activity against IoT devices within the context of Operation CameraSwarm.
Detects HTTP responses containing content that clones the RTX Corporation homepage, often associated with SilkParasite C2 infrastructure. The rule flags matches based on embedded text in the HTTP body combined with specific nginx server header fingerprints.
This rule detects email or web proxy traffic containing a lure themed around 'Confluence', combined with a redirect or link to Telegram, and specifically containing Cyrillic character sets. This combination is often indicative of targeted phishing campaigns using social engineering lures to redirect users to external messaging platforms for further interaction or credential harvesting.
Page 472 of 1168