Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of mklink.exe or cmd.exe with mklink arguments to create symbolic links associated with specific file paths (ProgramData\doxc) or specific suspicious filenames (hzwzucr_widsisa.exe). This behavior is often associated with malware persistence or evasion, where adversaries link malicious binaries to disguise their location or execution source.
Detects macOS shell processes (bash/sh/zsh) executing curl to fetch portable Python bootstrap files from known indicators associated with CRPx0/ClickFix campaigns. This typically involves downloading python-build-standalone environments or staging scripts from external endpoints.
Detects the use of command-line tools like find and grep to recursively search the filesystem for files containing sensitive information, such as configuration files, environment variables, database credentials, and digital wallet keys. This behavior is indicative of an attacker performing automated discovery of credentials and secrets.
This rule detects a high volume of unique command executions within a short time window where the command lines contain patterns resembling developer or script comments (e.g., # or // followed by keywords like 'attempt', 'retry', 'diagnos'). The threshold-based logic (over 600 unique commands in less than 1 hour) combined with high-frequency retry attempts suggests automated or scripted activity, potentially indicative of automated exploitation frameworks, reconnaissance, or brute-force tools that include verbose logging or internal notes within the command execution.
This rule detects DNS queries and TLS SNI connections to 'devtunnels.ms'. This domain is associated with Microsoft Dev Tunnels, a service that exposes local development environments to the internet. Adversaries may abuse this legitimate service to establish reverse tunnels or proxies, enabling lateral movement and bypassing inbound network restrictions.
Detects a suspicious correlation where a host reports a confirmed exploit attempt followed by a high volume of file modifications (encryption behavior) within a single hour. This short dwell time is a strong indicator of automated or AI-orchestrated ransomware deployments.
This rule monitors for suspicious memory-based code execution patterns, such as reflective loading or execution of code from memory segments marked with executable permissions (PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_READ) that do not originate from a signed Microsoft file. It specifically flags memory regions containing the MZ header that lack a corresponding backing file, as well as specific known suspicious DLL patterns or memory protection flag changes indicative of process injection or fileless execution.
Detects thread creation where the start address resolves to the 'AnimateWindow' function within 'user32.dll'. This behavior is a known indicator of thread-hijacking techniques, such as those implemented by the SparroWocky framework using the MinHook library, where the thread entry point is spoofed to evade detection.
This rule detects the presence or execution of known malicious DLL files (winfsp-x64.dll or DukeQt.dll) by monitoring process rollups, image loads, and file operations. The detection is triggered by matching the file name against specific SHA1 hashes associated with known malicious activity.
Detects the creation of threads where the entry point or call stack is associated with 'kernel32.dll' but originates from memory regions that are unbacked by a file on disk (i.e., 'unbacked', 'unknown') or have a null return address. This pattern is highly indicative of reflective code injection or manual shellcode execution, where an adversary attempts to execute code within a legitimate Windows process without a corresponding file-backed image.
Page 535 of 1168