Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of cryptocurrency mining (XMRig) and suspicious process masquerading on Linux systems, alongside container-related events referencing known malicious or suspicious strings such as 'GH0ST_C2' or 'fsociety'.
Detects the downloading of Android application packages (.apk) from potentially untrusted or non-official third-party portals, which are often used in smishing or malvertising campaigns to deliver malicious applications to user devices.
Detects outbound network requests from non-standard Android application processes to Google's generative-AI API endpoints (e.g., Gemini). This behavior is indicative of malware, such as RatHat, attempting to exfiltrate accessibility information or UI trees to an LLM to facilitate automated screen interaction and navigation.
Detects a malicious sequence of actions originating from an Android Accessibility Service, specifically the 'SystemHelperService'. The activity involves the programmatic enablement of Developer Options and Wireless Debugging, followed by the unauthorized extraction of an ADB pairing PIN from the screen, bypassing user interaction requirements.
Detects a behavioral pattern associated with the NeedyMantis first-stage loader, which involves the loading of specific suspicious DLLs (masquerading as common software components) followed by the extraction or creation of an 'encryptbase64.ps1' second-stage loader within a short timeframe (10 minutes) on the same host.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
Detects the execution of the suspicious shared library 'liblocal-service.so' from the '/data/local/tmp/' directory, initiated by the 'shell' user or an ADB parent process. This activity is associated with malicious behavior where Android debug bridge (ADB) is abused to stage and execute native daemons for privilege escalation or unauthorized system access.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
Detects network patterns associated with NeedyMantis-style command-and-control (C2) activity. This includes specific HTTP GET requests with hardcoded User-Agent strings, cookie-based binary data transfer in server responses, and WebSocket communication attempting to establish binary protocol channels.
Page 52 of 1168