Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation or modification of Fortinet VPN-related configuration, command, or script files on a system. Attackers may target these files to gain unauthorized access, modify VPN parameters, or extract sensitive connection information.
Detects suspicious PowerShell execution patterns characterized by the 'ClickFix' social engineering technique. This involves an attacker tricking a user into copying and pasting a PowerShell command into their terminal, often disguised as a fake reCAPTCHA or security verification page. The rule monitors for PowerShell processes spawned by common user-facing applications (explorer.exe, conhost.exe, WindowsTerminal.exe) that contain specific command-line arguments like 'iex(irm' or 'iex(iwr'.
Detects the creation of an administrative account named 'adminin' on FortiGate devices. This specific account name has been linked to the 'FortiBleed' credential theft campaign, which often serves as a precursor to ransomware deployment by threat actors like the INC Ransom group.
Detects unauthorized processes attempting to access sensitive browser credential files ('Login Data', 'Local State', 'key4.db', 'logins.json') which are typically associated with stored passwords and profile data. The rule specifically excludes common web browsers (Chrome, Edge, Firefox, Brave, Opera) to reduce noise from legitimate browser operations.
This rule detects DLL side-loading attempts by identifying signed processes that load unsigned or invalidly signed DLLs from the same directory as the initiating process, specifically excluding standard system directories (System32, SysWOW64, WinSxS) to reduce noise. This behavior is a common technique used by attackers to execute malicious code under the context of a trusted, legitimate application.
Detects the usage of the 'docker cp' command containing directory traversal sequences ('../') in the destination argument. This behavior is associated with a known container escape technique where an attacker can overwrite files on the host filesystem by escaping the container's designated storage path.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Page 575 of 1168