Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,570 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Microsoft 365 MailItemsAccessed events where the email subject or body contains finance-related keywords such as 'invoice', 'payment', 'bank details', or 'wire'. This activity may indicate malicious mailbox scanning or data collection, often associated with unauthorized access or automated enumeration tools like the ARToken Inbox Monitor.
Detects phishing emails leveraging finance or accounts-payable themes (e.g., invoices, payment confirmations, bank detail updates) that contain known ARToken phishing template strings. This activity is indicative of credential harvesting via device code authorization flow abuse.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
Detects artifacts, domains, and web content associated with the Rapuncel MaaS phishing campaign. The rule specifically targets HTML/JS markers from fake LastPass Authenticator GitHub Pages sites, which employ social-engineering tactics such as fake trust badges and malicious download prompts to distribute the Rapuncel infostealer.
Detects multiple anomalous sign-in events using the device-code authentication flow within an Entra ID tenant. The rule correlates sign-ins from geographically disparate IP addresses (often associated with known attacker infrastructure or proxies) using device-code flows, which is a technique used in 'ARToken' style phishing campaigns to compromise multiple user accounts in a short timeframe.
Detects unauthorized processes accessing cryptocurrency wallet data files, including 'wallet.dat' or specific browser-based extension storage databases (e.g., MetaMask, Coinbase Wallet), which is indicative of the Rapuncel stealer attempting to exfiltrate sensitive wallet data.
Detects the delivery of Rapuncel infostealer via abnormally large ZIP archives that incorporate binary padding with junk DLL files (such as TitanStorage.dll or ProManager.dll). This technique is used to evade security scanners that have file size limitations. The rule tracks specific campaign filenames and junk file markers.
Detects modifications to the 'HKCU\Software\Classes\ms-settings\shell\open\command' registry key, a technique used to hijack the fodhelper.exe binary to achieve silent UAC elevation. This allows attackers to execute commands with administrative privileges without triggering a UAC prompt.
Detects the execution of hidden, base64-encoded PowerShell commands spawned directly from explorer.exe, a pattern observed in the CRPx0 ClickFix campaign where attackers trick users into pasting malicious commands into the Windows Run dialog.
Detects execution of rundll32.exe using ordinal-based export calling syntax to load suspicious DLLs (e.g., sys_<hex>.dll) or reference non-executable files (e.g., WindowsUpdate.log). This behavior is consistent with the CRPx0 Stage 2 stager, which typically exports crypto globals and lacks standard named exports.
Page 540 of 1168