Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,571 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.
This rule detects the execution of the 'FortiEndpoint_Patch.exe' binary when command-line arguments typically used for status queries, data retrieval, or export tasks (such as 'list', 'search', 'view', or 'export') are passed to it. This monitoring identifies potential reconnaissance or information gathering activities performed by an attacker interacting with Fortinet endpoint management utilities.
This rule detects the creation of a scheduled task, either via schtasks.exe or Event ID 4698, where the task content points to a suspicious, user-writable directory (e.g., Temp, AppData). It correlates this activity with the presence of known Loader/Stealer process indicators (HijackLoader/Vidar) occurring within a 15-minute window on the same host, indicating likely persistence establishment by malicious software.
Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).
Detects unauthorized processes (non-browser related) attempting to modify Chrome/Chromium user profile preference files or sensitive browser registry keys related to search providers and security MACs. This activity is often associated with browser hijacking, malware persistence, or unauthorized manipulation of browser settings.
Detects anomalous behavior associated with the 'tcc.exe' executable, which is often leveraged by the BeepRAT loader for malicious operations. The rule monitors for suspicious process start flags ('-nostdlib', '-run'), execution from unconventional locations (outside of standard Program Files), the spawning of common shell processes (cmd.exe, powershell.exe, etc.), and unsolicited outbound network connectivity. This rule effectively flags potential loaders or backdoor activity originating from this binary.
Detects registry enumeration activities targeting HKLM software keys related to Windows versioning and system configuration. This pattern is characteristic of BeepRAT post-compromise reconnaissance, where an adversary attempts to gather system information to profile the environment.
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
Detects a suspicious volume of image file creation events (more than 3) within the 'C:\Users\Public\Videos\' directory, matching a pattern commonly used for automated screen capture tools.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
Page 593 of 1168