Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,573 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
This rule detects modifications to the Image File Execution Options (IFEO) registry key for the agent service 'agntsvc.exe'. It identifies when an adversary configures a 'Debugger' registry value or a specific systray-related value, which is a known behavior of the Pay2Key ransomware for persistence and potential privilege escalation or process interference.
Detects the execution of a process named 'fortiendpoint_patch.exe' located outside the authorized Fortinet program files directory, which is indicative of potential masquerading by an adversary attempting to hide malicious activity under a legitimate-sounding process name.
This rule detects network connections to external (non-private) IP addresses on port 8013. Additionally, it identifies potential anomalies where a network request on this port contains a message indicating that the required certificate was not found in the HTTP request header, which may indicate unauthorized or malicious activity, such as C2 communication attempt over non-standard ports or communication bypass.
This rule monitors network traffic to detect potential scanning activity by identifying single remote IP addresses communicating with more than 50 distinct internal hostnames within the observed timeframe. This behavior is often indicative of automated reconnaissance, such as vulnerability scanning or network discovery, performed by an adversary attempting to map the environment.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
Detects disguised malicious files, typically mimicking XML or MAP documents, that contain multiple PNG IDAT chunk markers but lack a valid PNG header and XML declaration. This signature is consistent with the HijackLoader staging technique, where XOR-encrypted and LZNT1-compressed data is hidden within the structure of spoofed file formats.
Detects behavior associated with the SnappyClient remote access trojan, specifically identifying the execution of 'VirtualAr.exe', which performs GDI-based screen capture and keyboard hooking via 'SetWindowsHookEx', followed by the staging of stolen data within the 'ProgramData\Mayanex\Nata' directory.
Detects the execution of PowerShell commands targeting a specific staging directory 'ProgramData\Zooms', typically associated with the ClickFix malware campaign. The rule flags processes invoking secondary payload retrieval via '.r2.dev' or 'dl-callback' patterns, which are indicative of staged second-stage download activities.
Page 606 of 1168