Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
This rule detects potential reconnaissance activity in Microsoft 365 environments by monitoring Graph API requests. It specifically looks for large-scale user enumeration patterns or queries containing keywords associated with HR, payroll, or sensitive financial information, often indicative of an adversary attempting to identify high-value targets. The detection focuses on both standard 'List' operations and specific URI patterns used for bulk data extraction.
Detects high-volume, potentially automated enumeration of Microsoft Graph API endpoints targeting sensitive personnel data (payroll, HR, finance). This rule identifies requests using non-standard or suspicious user agents—such as curl, python-requests, or common web client patterns—when interacting with user and group directories in the Microsoft 365 environment, characteristic of the 'Payroll Pirate' (Storm-2755/Storm-2657) campaign patterns.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
This rule detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that hijacks browser search functionality. The detection monitors for three distinct indicators: the creation of specific extension files within the Chromium directory, network communication with attacker-controlled domains (perplexity-ai.online, extension.tilda.ws), and registry modifications that override default search settings.
Detects browser processes (Edge or Chrome) connecting to known IP geolocation or fingerprinting services within 3-5 days after a new extension has been registered. This behavior is consistent with malicious browser extension 'dormancy gating' and environment fingerprinting techniques, often used by malware (such as StegoAd) to confirm they are running on a real user host before activating payloads.
Detects Microsoft Edge or Google Chrome spawning suspicious shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe), which is characteristic of the StegoAd browser extension campaign. The rule specifically flags browser processes launching script interpreters with command-line arguments containing obfuscated content (e.g., base64, eval) or references to specific image files (e.g., loading.webp, .woff2) used for steganographic payload delivery.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects unauthorized or suspicious installation and configuration of the OpenSSH server on Windows endpoints. This rule monitors for process creation of OpenSSH-related binaries, configuration of SSH services (e.g., via sc.exe, PowerShell, or winget), and modification of SSH-related configuration files and registry keys, which are often indicative of attackers establishing persistent backdoor access.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Page 612 of 1168