Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects scenarios where a web server process or control panel utility (such as cPanel or Plesk) appears to initiate a shell process (sh, bash, dash) as the root user. This behavior is highly indicative of a compromise where an attacker has achieved command execution in an elevated context following an exploit against a web application or control panel interface.
Detects the creation of a new administrator account in WordPress by monitoring for SQL INSERT operations targeting the wp_users and wp_usermeta tables that involve setting the wp_capabilities to administrator. This behavior is indicative of unauthorized account creation often associated with compromised or malicious WordPress plugin updates.
Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.
Detects web server processes invoking user creation scripts or functions specifically associated with the 'admin-menu-editor-pro' WordPress plugin. This activity is indicative of an attacker attempting to create a new administrative user account after exploiting a vulnerable WordPress plugin or site configuration.
Detects unauthorized creation of a WordPress administrator account through direct SQL injection or manual database modification by monitoring for insertions into the 'wp_users' table or modifications to the 'wp_usermeta' table with 'administrator' capabilities.
Detects instances where a user account experiences an 'Unusual sign-in' event followed by the registration of a new MFA or security information method within a one-hour window. This behavior is indicative of an attacker attempting to establish persistent access by registering their own authentication device to a compromised account.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.
Detects the use of chmod or chown commands to modify permissions or ownership of files associated with Acronis backup plugins within cPanel, WHM, or Plesk environments. This activity is indicative of potential unauthorized manipulation or exploitation of the backup configuration, such as that associated with CVE-2026-87886.
Detects DNS queries and established TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused by adversaries to establish tunnels for unauthorized remote access, such as tunneling RDP traffic to bypass network security controls.
Page 502 of 1168