Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,564 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects successful authentication events using the device code flow for specific end-user applications including Windows App, Azure Virtual Desktop, and Windows 365. This pattern is often utilized in legitimate workflows but can also be abused to gain access to corporate resources.
Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
Detects execution patterns associated with the ClickFix attack vector on macOS, where Terminal.app spawns a piped curl-to-shell command, typically used as an initial entry point for malware such as the AMOS (Atomic macOS) stealer.
Detects a specific credential-harvesting sequence associated with the RatHat malware. This behavior involves an initial malicious overlay drawn over a targeted application to harvest credentials, followed by a secondary fake 'install failed' overlay masquerading as Google Play within a short timeframe (1 hour), occurring when a user attempts to uninstall the malicious application.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
Detects a sequence of events starting with a user signing in via the OAuth device code flow, followed immediately by mailbox item enumeration and sending of email. This pattern is characteristic of attackers who use device code phishing to steal tokens, subsequently using those tokens to access mailboxes and send malicious emails from the compromised account.
This rule detects phishing emails attempting to impersonate Apple or Find My services by monitoring for specific sender display names and subject lines. It specifically flags messages originating from personal email providers like Gmail and iCloud that do not belong to the legitimate apple.com domain, which is a tactic often associated with device-recovery lures used in phishing campaigns.
Page 484 of 1168