Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Detects successful VPN authentication attempts originating from known Cloudflare WARP tunnel infrastructure or European VPS provider IP address ranges. This pattern is often used by adversaries to mask their true geographic origin or bypass location-based security policies.
Detects potential database-native ransomware activity by identifying the use of MySQL encryption functions (AES_ENCRYPT) to encrypt records followed by the execution of DROP TABLE commands. This pattern is consistent with extortion techniques where attackers encrypt internal database data and remove original tables.
This rule detects potentially malicious behavior by correlating intensive usage of graphics-related API calls (like BitBlt, GetDC, etc.) which are indicative of screen capture, with the execution of specific command identifiers typically associated with C2 (Command and Control) traffic. The combination suggests an adversary is capturing screen data and potentially staging or exfiltrating it via a C2 channel.
Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.
Detects outbound TLS and HTTP traffic directed towards 'testing.perplexity.com', an unlocked test subdomain reportedly associated with the BragJack campaign for AI agent hijacking. This indicates potential interaction with an adversary-controlled or compromised infrastructure used to intercept or manipulate AI agent sessions.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.
This rule detects HTTP POST requests to the Telegram Bot API where the request body contains specific action keywords (e.g., VIEW or MOBILE). This pattern is often indicative of C2 communication using legitimate Telegram infrastructure to control compromised systems.
Detects outbound network connections (both TCP and TLS) from internal hosts to known command-and-control (C2) infrastructure associated with the SparroWocky malware family. This rule monitors for established connections to a curated list of malicious IP addresses over ports 443 and 8080.
Page 563 of 1168