Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
This rule detects potential exploitation attempts targeting vulnerabilities in FortiClient EMS. It specifically looks for indicators such as requests lacking proper certificate headers or suspicious requests to 'service/save.php' on the FortiClient EMS server, which are commonly associated with CVE-2026-35616.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
Detects the execution of PowerShell via explorer.exe using hidden windows styles and encoded commands. This behavior is often associated with fileless execution, initial access via malicious attachments or documents, and various obfuscation techniques used by adversaries to evade detection.
Detects high-volume file creation events (more than 50 within 5 minutes) on an endpoint using specific file extensions associated with known ransomware families such as INC Ransom (.inc) and Lynx (.lynx).
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window styles, and suspicious cmdlets like IEX or WebClient) when launched from explorer.exe. This pattern is commonly associated with fileless malware execution or malicious script downloads.
Detects Microsoft Defender service (MsMpEng.exe) spawning common interactive or scripting processes (such as cmd.exe, powershell.exe, etc.) while running as SYSTEM. This behavior is highly irregular for an antivirus engine and is characteristic of exploit-based process hollowing or quarantine pipeline abuse, as observed in CVE-2026-50656.
This rule identifies accounts, hosts, and remote IP addresses associated with a high volume of Remote Desktop Protocol (RDP) logon activity, which may indicate brute-force attempts, credential stuffing, or anomalous remote access behavior.
Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Page 569 of 1168