Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
This rule detects attempts to clear Windows event logs using either the 'wevtutil.exe' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. Adversaries often clear event logs to hide evidence of their activity on a compromised host.
Detects execution and file activity associated with Sysinternals AD Explorer, a tool often used by adversaries to enumerate Active Directory environments and perform snapshots.
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
This rule monitors for RDP connections (Windows Event ID 4624 Logon Type 10) and RDP client launches (mstsc.exe) within an environment. It enriches these events by checking against a baseline of historically observed source-to-destination host pairs. A new or previously unseen connection pair triggers an alert, helping to identify potential lateral movement.
Detects various indicators of credential dumping associated with Mimikatz and manual extraction of the Active Directory database (NTDS.dit). This includes execution of Mimikatz, use of specific modules like lsadump::dcsync and sekurlsa::logonpasswords, direct access to the LSASS process, and usage of ntdsutil or vssadmin to create shadow copies for NTDS.dit file access.
This rule detects the creation or modification of core Chrome extension files (manifest.json, background.js, search.html) within the Chrome User Data directory by processes other than standard Chrome executables (chrome.exe, chromium.exe, googleupdate.exe). It also includes a specific alert for a known extension identifier. This activity is often indicative of unauthorized browser extension installation, potentially for persistence, credential theft, or malicious C2 activity.
Detects the download of JPEG image files to suspicious system directories (e.g., C:\Windows\, C:\ProgramData\) followed by subsequent file read operations by non-image viewer processes, which is indicative of steganographic payload extraction used in campaigns such as Operation DragonReturn/DcRAT.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Page 584 of 1168