Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,318 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to AWS IAM policies (user or role policies) that grant AdministratorAccess, PowerUserAccess, or wildcard permissions (*). This is a common indicator of privilege escalation or persistence, where an attacker grants themselves or another identity broad administrative access within the AWS account.
Detects DCSync attacks by monitoring for EventID 4662 where Active Directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) are requested. This behavior is indicative of unauthorized replication attempts used to extract sensitive data, such as password hashes, directly from a Domain Controller.
This rule identifies potential command and control (C2) beaconing activity by detecting periodic, low-jitter outbound network connections. It analyzes network logs to find connections to external IP addresses that maintain a consistent frequency over a period of time, specifically flagging hosts that demonstrate repetitive traffic patterns with low variation (jitter). The rule further filters by identifying 'rare' destinations, focusing on remote IPs that have been connected to by three or fewer hosts within the environment, which is a common indicator of targeted C2 infrastructure.
Detects Kerberos ticket requests (AS-REQ/TGS-REQ) that exhibit characteristics of a forged Golden Ticket, specifically the use of legacy RC4 (0x17) encryption in environments where AES is typically preferred, non-standard ticket options (0x40810000), and requests for accounts or services that lack a corresponding legitimate authentication event. This detection aims to identify the post-compromise phase where an adversary uses a forged TGT to impersonate domain accounts.
Detects the execution of rclone.exe or a renamed rclone binary using common command-line arguments (copy, sync, config, --progress). Rclone is a popular tool for ransomware double-extortion, as it allows attackers to exfiltrate data to various cloud storage providers while blending into legitimate network traffic.
This rule detects PowerShell processes (including pwsh and ISE) referencing Anti-Malware Scan Interface (AMSI) related classes and methods in their command line arguments. This is a common indicator of an attempt to interact with or manipulate AMSI, often used to bypass or disable security scanning during the execution of malicious scripts.
Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.
This rule detects modifications to Windows Registry 'Run' or 'RunOnce' keys that point to executables or scripts located within suspicious user-writable directories such as AppData, Temp, or Users Public. This is a common technique used by adversaries to establish persistence on a compromised host.
Detects the execution of known Windows system binaries (rundll32, regsvr32, mshta, msiexec) with command-line arguments indicative of proxy execution or script-based attacks. The rule identifies patterns commonly associated with downloading or executing remote payloads, including the use of URLs, JavaScript, VBScript, or specific DLL exports designed to execute code indirectly or from a remote source.
Detects the invocation of Active Directory replication rights by monitoring Event 4662 for specific directory service replication GUIDs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All). This behavior is characteristic of adversary techniques such as DCSync used by tools like Mimikatz lsadump::dcsync or Impacket secretsdump to extract domain password hashes.
Page 55 of 1168