Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potentially malicious network traffic that suggests command and control or data exfiltration. It identifies connections using non-standard ports (above 1024, excluding common ports) or abnormally long DNS queries, often associated with DNS tunneling. The rule aggregates these events by host and destination to identify persistent or high-volume patterns indicative of covert channels.
Detects anomalous internal lateral movement activity where the Remote Desktop client (mstsc.exe) establishes network connections to multiple distinct internal destinations within a short window, potentially indicating an attacker traversing the network.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
Detects the creation of applications or service principals in Azure AD that involve sensitive OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All) when performed by users identified with elevated risk levels or outside of standard business hours.
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
Detects the creation or modification of Windows Registry Run keys or the addition of files into the startup directory. These are common persistence mechanisms used by adversaries to ensure programs execute automatically upon system boot or user logon.
Page 574 of 1168