Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.
Detects the execution of BQTLock ransomware loader components (start.exe or BQT.exe) that contain embedded PyInstaller environment artifacts. The rule monitors for processes that incorporate specific environment variables associated with PyInstaller-packaged binaries, which are often used by this malware to detect debugger presence and sandbox environments before proceeding with its primary malicious functionality.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
This rule detects instances where Microsoft Edge or Google Chrome are launched with the --load-extension command line argument pointing to non-standard or suspicious directories (such as Temp, Downloads, or ProgramData). These locations are often used by malicious extensions to evade detection. The rule also flags instances where these browsers are launched by suspicious parent processes, which may indicate automated installation or control by malicious actors.
Detects the creation or modification of inbox rules via PowerShell, specifically targeting cmdlets commonly used by attackers to hide phishing indicator emails, security alerts, or C2 communications by moving or deleting them into folders like Junk, Deleted Items, or Archive. The rule monitors for both direct usage on the endpoint and remote administration patterns via Exchange Online/EWS remoting.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
Detects a suspicious sequence where 7-Zip is used to extract a RAR archive, immediately followed by the creation of executable files (.exe, .bat, .cmd, etc.) in common user-writable directories. This chain often indicates an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted by archive tools may not inherit the MotW zone information, allowing potentially malicious files to execute without security prompts.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
Detects browser processes (Chrome, Edge, Firefox, IE) being launched with a URL containing a crafted Microsoft 365 Copilot Search parameter (q=) with an unusually long command line. This pattern is indicative of potential exploitation attempts such as CVE-2026-42824 (SearchLeak), where attackers inject malicious payloads or HTML/script tags into the search query string to be processed by the browser.
Page 611 of 1168