Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,569 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network requests to script.google.com that include a specific action parameter indicating potential interaction with Google Apps Script web macros. Attackers often use Google Apps Script as a proxy or webhook for C2 communication, data exfiltration, or to serve malicious payloads due to its reputation and ease of use in bypass scenarios.
Detects network requests to script.google.com that include a specific action parameter indicating potential interaction with Google Apps Script web macros. Attackers often use Google Apps Script as a proxy or webhook for C2 communication, data exfiltration, or to serve malicious payloads due to its reputation and ease of use in bypass scenarios.
Detects persistence attempts related to the NetSupport Manager remote access tool by monitoring modifications to Windows Registry keys associated with run keys, Winlogon notification packages, and services.
Detects the execution of cmd.exe with command-line arguments typical of self-deleting batch scripts. The pattern includes a delay (timeout /t 2) followed by a file deletion command (del), often used to remove temporary scripts or malicious artifacts after execution.
Detects the installation or update of browser extensions that utilize 'declarativeNetRequest' or 'webRequest' APIs in conjunction with 'content_scripts' and either broad URL access ('all_urls') or access to sensitive web domains (e.g., Google Gemini, Microsoft Copilot, Perplexity, Claude). This combination is highly indicative of extensions designed for data interception, credential theft, or unauthorized web traffic manipulation.
This rule detects potentially malicious file access patterns by the executable 'comet.exe'. It alerts when this process accesses sensitive files or directories associated with credentials, configuration files, or sensitive browser data, while explicitly excluding benign locations such as Chrome data folders and temporary directories.
Detects the execution of a hidden PowerShell process that subsequently spawns a child process using the 'Start-Process' cmdlet with the '-Verb RunAs' argument within a short time window. This pattern is commonly associated with attempts to bypass User Account Control (UAC) or execute processes with elevated privileges silently.
Detects the execution of 'client32.exe', which is the executable associated with NetSupport Manager, a legitimate remote management software often abused by adversaries to establish persistence and provide remote interactive access to compromised systems.
This rule detects potentially unauthorized installation of root certificates on Windows and macOS systems. Attackers use this technique to bypass security warnings, establish adversary-in-the-middle capabilities, or inspect encrypted traffic by adding their own certificates to the system's trust store.
Detects the execution or loading of specific components (winfsp-x64.dll, DukeQt.dll) associated with the SparroWocky malware framework, or suspicious image load events lacking a defined module path that typically precede reflective mapping.
Page 507 of 1168