Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of the Sysinternals ADExplorer tool for Active Directory environment exploration, including the creation of snapshots or data dumps, as well as the use of the native 'net' utility to enumerate domain users and groups. These activities are common indicators of internal reconnaissance and discovery phases during an attack.
Detects the execution of ADExplorer.exe with the command-line arguments to perform a snapshot export. AD Explorer is a legitimate administrative tool often abused by adversaries to perform offline NTDS.dit extraction or to enumerate Active Directory objects.
Detects instances where known post-exploitation tools or techniques (AD Explorer snapshots, staging of screen captures in public directories, or credential stealer execution) are followed by successful outbound network connections from the same device within a 30-minute window. This behavior often correlates with the collection and subsequent exfiltration of sensitive information.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '../') in the destination path. This pattern is indicative of an attempt to escape the container filesystem boundary and write arbitrary files to the host system by exploiting vulnerabilities in the docker cp utility.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
This rule detects attempts to exploit an unauthenticated administration API vulnerability (CVE-2026-35616) in FortiClient EMS versions 7.4.5 and 7.4.6, commonly referred to as FortiBleed. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the administration interface.
Page 577 of 1168