Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects the execution of PowerShell with suspicious command-line arguments (obfuscation, hidden windows, or encoded commands) directly spawned from explorer.exe. This activity is frequently associated with malicious scripts or payloads executing in the context of user activities to evade detection.
Detects malicious PowerShell scripts that perform reflective loading of .NET DLLs into memory. The rule identifies patterns associated with the 'ClickFix' or 'StealC' loaders, specifically looking for combinations of Assembly.Load, GZip decompression, and hardcoded AES encryption keys/IVs frequently used by these campaigns.
Detects unauthorized access to sensitive browser files, specifically 'Login Data' (passwords) and 'Cookies', by processes other than authorized browser binaries (Chrome or Edge). This is a common indicator of credential harvesting or session hijacking attempts by malware or malicious actors.
Detects the presence of the known vulnerable gdrv.sys driver on disk. This driver is frequently utilized in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode access, which is often leveraged to disable endpoint security products or escalate privileges.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
Detects the use of the native Windows utility cipher.exe with the /w flag executed from the command prompt. The /w switch instructs cipher to remove data from available unused disk space, which is a technique often used by threat actors to hinder forensic recovery of deleted files.
Page 473 of 1168