Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
This rule detects the creation of or connection to the hardcoded 'RoguePlanet' named pipe, which is utilized as an IPC synchronization channel by the Nightmare Eclipse Defender exploit. The rule monitors for both pipe creation and connection events via Sysmon and Defender for Endpoint (DeviceEvents) telemetry, flagging potential malicious usage or interactions with security processes.
Detects anomalous process execution chains where Fortinet FortiClient scheduler processes (scheduler.exe or FortiTray.exe) spawn cmd.exe to execute command scripts, or subsequently spawn PowerShell with obfuscated command line arguments (-enc, -EncodedCommand) and hidden window flags (-w 1), as identified in the FortiBleed campaign.
This rule monitors proxy and network detection and response (NDR) logs for outbound HTTPS requests to Cloudflare R2 (*.r2.dev) and Cloudflare Pages (*.pages.dev) domains. These platforms are frequently abused by adversaries for hosting malicious payloads, particularly in ClickFix-style social engineering campaigns. The rule specifically flags connections that involve the download of common executable, script, or archive file extensions, as well as recurring traffic patterns to these domains.
Detects the creation of an NTFS Alternate Data Stream named :WDFOO in temporary staging directories, often associated with wermgr.exe and subsequent Windows Defender scans. This behavior is indicative of a TOCTOU (Time-of-Check Time-of-Use) exploitation chain, specifically linked to the RoguePlanet exploit targeting CVE-2026-50656, where EICAR test strings are used to manipulate anti-virus detection flows.
This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.
Detects persistence attempts by monitoring modifications to Windows 'Run' registry keys, the creation of executable files (.exe, .lnk) within the user's startup directory, or the use of common command-line utilities (reg.exe, powershell.exe) to modify these autostart persistence locations.
Detects the creation of working directories in temporary locations matching the RoguePlanet exploit staging pattern, specifically associated with CVE-2026-50656 (Nightmare Eclipse). The rule identifies the creation of directories containing fake System32 subdirectories or suspicious files (wermgr.exe) used in a TOCTOU (Time-of-Check Time-of-Use) exploit chain against MsMpEng.exe.
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
Page 570 of 1168