Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
This rule detects Socket.IO WebSocket handshake attempts or Engine.IO connection openings targeting TCP port 1313. This pattern is commonly associated with administrative tools, backdoors, or command-and-control frameworks that utilize WebSocket communication over non-standard ports to bypass security controls.
Detects instances where a process that is not a known web browser (specifically excluding chrome.exe and msedge.exe) attempts to access sensitive browser files such as Login Data, Cookies, or Local State. This behavior is indicative of unauthorized attempts to steal stored web credentials, commonly associated with infostealer malware or browser credential theft tools.
Detects the execution of Mimikatz specifically utilizing the lsadump::dcsync command or the internal DRSGetNCChanges function call. These behaviors are indicative of an adversary performing directory replication abuse against a Domain Controller to extract sensitive Active Directory credentials, including password hashes.
This rule detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of registry run keys, the use of 'reg.exe' to add entries to run keys, and the creation of shortcut files (.lnk) in the Windows Startup directory.
Detects unauthorized processes attempting to read, modify, create, or rename browser sensitive data files such as 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. This activity is a common indicator of credential theft or session hijacking.
Detects the modification of the EnableLUA registry key via the reg.exe utility. Setting EnableLUA to 0 effectively disables Windows User Account Control (UAC), which is a common post-exploitation technique used to elevate privileges or bypass security prompts.
Detects the creation or modification of known malicious files associated with the StegoAd (DarkSpectre) campaign. The rule monitors popular Chromium-based browsers (Chrome, Edge, Brave) dropping specific files like 'msn.woff' (malicious font), WebP containers (steganography), and 'setting.conf' (C2 configuration) into browser-related directories such as AppData or extension storage folders.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Page 594 of 1168