Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the execution of cmd.exe with a command line argument (/c) spawned directly from common application entry points such as Microsoft Office (Word, Excel, PowerPoint, Outlook) or scripting engines (wscript.exe, cscript.exe). This pattern is a common indicator of malicious macro-based execution, weaponized document exploitation, or script-based secondary payload execution.
Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.
This rule identifies endpoints that have transferred a total of more than 50MB of data to a single external, non-private IP address. The detection filters out RFC1918 private subnets and local loopback traffic, aggregating byte counts and connection attempts per endpoint, computer, and destination. This is indicative of potential data staging or exfiltration activities.
Detects a potential exploitation of the SearchLeak (CVE-2026-42824) vulnerability in Microsoft 365 Copilot, where raw HTML <img> tags containing Bing Search-by-Image parameters are rendered during the streaming phase before proper sanitization occurs. This could potentially allow for SSRF or information leakage through malicious image references.
This rule detects a multi-stage attack chain associated with the SnappyClient RAT (Operation Turb00). The detection logic correlates: 1. Execution of known malicious processes (AlphVector, WizardDa42, VirtualAr, or Crisp); 2. Persistence mechanisms including specific registry keys (CadenceOptimizer) or file artifacts (shortcut links, scheduled tasks, Mayanex data dir, or CorsairUtil DLL); and 3. Outbound network traffic on ports 3333 or 3334 to external IP addresses.
Detects the loading of DLLs by signed processes from suspicious, user-writable, or known staging directories associated with malware loaders like HijackLoader. The rule monitors for module load events involving paths such as AppData, ProgramData, and user profile subdirectories, while excluding known legitimate publishers and paths.
Detects potential exploitation attempts against FortiClient EMS versions 7.4.5-7.4.6, specifically targeting the administration API on port 8013. The detection identifies unauthorized access attempts indicated by the log entry 'Certificate not found in request header', which correlates with exploit behavior for CVE-2026-35616.
This rule monitors for two indicators of potential ransomware activity: first, a surge in file renaming or creation events across multiple directories within a short window, suggesting large-scale encryption; second, the creation of potential ransom note files across multiple directories or devices. It uses Microsoft Defender for Endpoint data to identify these patterns as part of an incident response strategy.
Detects anomalous activity associated with the exploitation of RustDesk session permission bypass vulnerabilities. Specifically identifies 'rustdesk.exe' spawning suspicious child processes (indicative of post-exploitation command execution) or initiating outbound network connections on non-standard relay ports, which may signal a compromised remote access session.
Detects large outbound network transmissions occurring on a host shortly after the creation of staged or archive files. This behavior is indicative of an attacker consolidating sensitive data (such as credentials or intelligence) into an archive and subsequently exfiltrating it over a Command and Control (C2) or other established network channel.
Page 572 of 1168