Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,574 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the spawning of potential Model Context Protocol (MCP) server processes immediately following or by package installation commands (npm, pip). This behavior is characteristic of malicious packages or typosquatted dependencies attempting to register or execute a malicious MCP server configuration upon installation in a developer environment.
This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.
Detects the execution of known Windows download utilities (curl, wget, certutil, bitsadmin, powershell) spawned directly from cmd.exe (batch script context). The rule focuses on commands referencing temporary directories or common download/transfer parameters, which are often indicative of staged malicious activity, such as fetching secondary payloads or tools.
Detects anomalous child process execution from PHP web handler processes (e.g., php-fpm, php-cgi) indicative of exploitation of the StreamBucket SOAP RCE vulnerability. The rule identifies spawning of common shell tools or access to sensitive process memory files (/proc/self/maps or /proc/self/mem) associated with ASLR defeat techniques used in this exploit chain.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
Detects unauthorized registry modifications to file association handlers under HKCR and HKCU. This behavior is used to achieve persistence by hijacking the default command executed when opening specific file types, a technique identified in Kimsuky APT's NUKESPED post-exploitation activity.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
Page 615 of 1168