Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,564 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network traffic consistent with the download of XMRig cryptocurrency miner release tarballs from GitHub, typically used in malicious deployment scenarios including automated cron-triggered installations.
Detects a malicious command sequence targeting Redis instances where an attacker uses 'CONFIG SET' to modify the 'dir' and 'dbfilename' configuration directives followed by a 'SLAVEOF' or 'REPLICAOF' command. This is a common exploit pattern used to achieve remote code execution by forcing the Redis instance to load a malicious database file (often containing binary webshells or cron jobs) from an attacker-controlled server.
Detects outbound HTTP GET requests containing a specific '/ping' URI pattern and 'h=' query string parameter, characteristic of Redis-based cryptomining botnet C2 heartbeat check-ins.
Detects instances where a Redis server process, or its child process, writes a file named 'verify.html' into the web root directory '/var/www/html/'. This behavior is characteristic of adversaries abusing compromised Redis instances to deploy web shells or command-and-control beacons for persistent access.
Detects unauthorized usage of Android Debug Bridge (ADB) commands for self-pairing or remote connection, along with behavioral indicators linked to the RatHat Go agent, including manual power management exemption settings, silent package installation with permission granting, and persistence via accessibility service enablement.
This rule detects the execution of specific suspicious binary names or processes loading a specific DLL from locations outside of the legitimate Windows System32 or SysWOW64 directories. This behavior is indicative of potentially malicious executables or side-loaded DLLs masquerading as system components or running from non-standard locations to evade detection.
This rule detects the presence of unauthorized WebView or HTML overlay windows rendered on top of active banking applications on Android devices. This behavior is indicative of credential-theft malware, such as banking trojans, which use overlays to capture user input, including banking credentials, while masking their activity over legitimate finance-related applications.
Detects instances of an executable named msedge.exe running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a suspicious location for a browser executable, often used by malware to masquerade as legitimate software to evade detection.
Detects the use of the 'getevent' utility by processes running under the 'shell' user (UID 2000) or accessing '/dev/input' directories, which is indicative of keylogging behavior often utilized by the RatHat Android malware to capture user input.
Detects the use of PowerShell to download files from Vultr Object Storage, specifically targeting patterns associated with the HEAVYGRAM malware distribution. The rule monitors for PowerShell cradles (WebClient, DownloadFile), archive extraction commands, or the execution of a specific payload name (RuntimeSSH.exe) often linked to the Handala Hack threat activity.
Page 487 of 1168