Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of a process named 's.exe' (or similar match) with a command-line argument consisting of a single character 's' followed by a digit. This pattern is commonly associated with malicious usage or obfuscation, where 's.exe' might be a renamed utility or a malicious artifact attempting to masquerade or execute specific tasks.
Detects instances where the Chrome browser process accesses camera or microphone hardware, or invokes media device APIs, potentially indicating unauthorized audio or video recording.
This rule detects rapid, repetitive state change operations (such as think, act, or mode changes) occurring within the Microsoft Edge browser context when interacting with Microsoft domains. This behavior is indicative of automated browser interactions, such as those performed by botnets, automated testing frameworks, or potentially malicious browser automation scripts.
This rule detects potentially malicious attempts to import certificates into the Windows certificate store using command-line tools like certutil or direct modification of the registry. This behavior is frequently associated with attackers attempting to establish persistence, bypass certificate validation, or install rogue trust anchors for man-in-the-middle operations.
Detects instances where common web browsers (Chrome, Edge, Firefox, Safari) or related desktop applications spawn shell interpreters (PowerShell on Windows, bash/zsh/sh on macOS) with command-line arguments indicative of malicious activity, such as base64-encoded payloads, hidden windows, or remote script downloading.
This rule detects the loading of specific DLLs (winfsp-x64.dll or dukeqt.dll) by processes from locations outside of the standard Windows System32 or SysWOW64 directories. This behavior is indicative of DLL side-loading, where an adversary attempts to execute malicious code by placing a rogue DLL in a path where a legitimate application might attempt to load it, or by intentionally side-loading it alongside an executable.
Detects browser-based processes (Chrome, Opera, Edge) making network requests to AI and cloud service domains (Google Gemini, Claude, Opera). This rule monitors for potentially unauthorized or excessive browser communication with these services.
Detects the creation of compressed archive files (zip, rar, 7z, dat) followed by a significant network upload (exceeding 5MB) on the same host within a 30-minute window, which is indicative of staging and exfiltrating collected data.
This rule detects network HTTP requests directed toward Google Scripts (script.google.com) or Google Docs (docs.google.com) where the referrer originates from Twitter or X. It further flags requests containing suspicious keywords like 'coindesk', 'conference', or 'hartmansdoeke', which are often associated with credential harvesting or malicious redirection campaigns leveraging trusted platforms.
Detects instances where the Google Chrome browser process interacts with files or registry keys associated with audio and video capture devices, such as cameras and microphones. This may indicate unauthorized use of media peripherals by the browser process.
Page 536 of 1168