Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of cmd.exe originating from the Remote Mouse or Peyara service process, correlating with an immediately preceding unauthenticated network connection on TCP port 1313. This behavior is indicative of exploitation of a remote service vulnerability, often associated with the Peyara Remote Mouse remote code execution exploit.
This rule detects outbound HTTP POST requests to dynv6-hosted infrastructure, specifically targeting communication patterns associated with Kimsuky campaigns. It monitors for exfiltration indicators such as the 'finalservice.php' endpoint, specific multipart form boundaries, and file indicators like 'Info.txt' used for data exfiltration.
This rule detects persistent, long-lived outbound network connections from a single device to external public IP addresses over common web ports (80 and 443). By calculating the connection count, total duration, and average interval between connections, it identifies periodic beaconing activity consistent with command and control (C2) communication patterns, such as those observed in UNC1549 TRUSTRAP traffic.
Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
Detects anomalous process execution chains originating from Gitea or Gitea Act Runner processes. This rule is designed to catch post-exploitation behavior associated with CVE-2026-20896, where an improperly configured reverse proxy allows an attacker to impersonate an administrator. The detection identifies shells, scripting interpreters, and network utilities spawned by the Gitea service, which may indicate command injection, malicious git hook execution, or CI/CD job abuse following an unauthorized administrative access.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Detects arbitrary code execution attempts against Ghidra 12.1.2 by monitoring for suspicious child process spawning from the Ghidra JVM. The rule identifies instances where java.exe, running in a Ghidra-related context, launches unauthorized binary interpreters or tools such as powershell.exe, cmd.exe, or other shell utilities often used as post-exploitation payloads.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
Page 605 of 1168