Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects browser extensions that inject hidden or invisible DOM elements (using display:none, visibility:hidden, or opacity:0) into specific AI assistant web pages (such as gemini.google.com or perplexity.ai). This behavior is characteristic of 'Prompt-Forcing' or 'BragJack' techniques, where malicious scripts attempt to smuggle unauthorized prompts into the AI's input channel through hidden fields, leading to unintended command execution.
Detects ClickFix-style social engineering attacks where users are prompted to copy and execute malicious commands in a shell environment. The rule triggers on process execution of terminal or shell binaries (zsh, sh, cmd.exe, powershell.exe) containing indicators of obfuscated execution or remote code downloading, such as piped shell commands (curl | sh/zsh) or PowerShell encoded command execution.
Detects high-frequency screen capture activity by monitoring process module loads related to BitBlt, GDI32.dll, and explicit screen capture descriptions. This rule identifies sustained screen scraping behavior (50+ events within a 5-minute window) indicative of the SparroWocky malware surveillance module's screen monitoring functionality.
This rule monitors Portable Executable (PE) files to identify those signed with certificates associated with Discord Inc. or Lenovo. Adversaries frequently abuse stolen or fraudulently obtained code-signing certificates from legitimate, reputable companies to bypass security controls like Windows SmartScreen, gain persistence, or increase the likelihood of successful malware execution.
This rule monitors Portable Executable (PE) files to identify those signed with certificates associated with Discord Inc. or Lenovo. Adversaries frequently abuse stolen or fraudulently obtained code-signing certificates from legitimate, reputable companies to bypass security controls like Windows SmartScreen, gain persistence, or increase the likelihood of successful malware execution.
Detects the use of the MinHook library to hook CreateThread and spoof the thread start address as AnimateWindow, a technique used by the SparroWocky malware to conceal its true thread origin from security monitoring tools.
Detects outbound TLS connections from internal hosts to known IP addresses associated with the SparroWocky command-and-control infrastructure, including the specific byte sequence used during the TLS handshake to signal a ready state.
Detects the use of 'Localcertificate.zip' and associated PowerShell or certutil commands used to install a rogue root certificate authority into the Windows certificate store. This technique is often used by adversaries to enable TLS interception for credential and session theft.
Detects anomalous, repeated 512KB multipart POST requests sent to a 'relay.php' endpoint, indicative of bulk data exfiltration performed by the CRPx0 ransomware prior to file encryption.
Detects the early-stage HTTP beaconing behavior of the CRPx0 ClickFix social engineering campaign. This rule monitors for specific request patterns to 'relay.php' that include session identifiers and indicators of the lure, such as 'WINUPDATE_TRACK' or 'CAPTCHA_WEB'. This signal represents the initial interaction with the malicious infrastructure before the victim is coerced into running commands.
Page 564 of 1168