Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential exploitation of a privilege escalation vulnerability (identified as CVE-2026-46331) involving the manipulation of Linux Traffic Control (tc) pedit actions or user/network namespace unsharing shortly after a setuid binary execution or root shell spawn. This behavior is indicative of a 'Copy-on-Write' (COW) or similar kernel-level vulnerability exploitation chain where unprivileged users abuse system features to gain elevated privileges.
This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
Detects indicators of Remcos RAT activity, specifically focusing on its use of native Windows utilities like attrib.exe, icacls.exe, and cmd.exe to modify file attributes, alter access control lists, or facilitate self-deletion. The rule also triggers when a identified Remcos-related process directly spawns these administrative tools for evasive actions.
Detects the use of living-off-the-land binaries (LOLBins) such as PowerShell, curl, certutil, bitsadmin, or mshta to download potential secondary payloads from self-hosted GitLab instances. This behavior is indicative of the Amadey loader chain, where compromised GitLab infrastructure is used as a repository to stage and distribute StealC or other malicious payloads.
Detects unauthorized access attempts to sensitive Chromium and Mozilla browser credential databases (e.g., Login Data, Cookies, Web Data, logins.json) by non-browser processes. This behavior is a common indicator of infostealer malware seeking to exfiltrate stored credentials for later decryption and abuse.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell Cmdlets, or WMI providers. These actions are common techniques for attackers to impair system defenses and remove evidence of their activities from a compromised host.
Detects reconnaissance activities targeting Active Directory, specifically focusing on the use of common enumeration tools like net.exe, net1.exe, and BloodHound/SharpHound binaries. The rule triggers when multiple enumeration commands or tool-specific execution artifacts are observed, suggesting preparation for lateral movement or privilege escalation.
Detects successful OAuth application consent grants or service principal role assignments involving sensitive permissions, such as read access to mail, contacts, files, or directory information. This activity is a common indicator of OAuth-based phishing or unauthorized persistent access to cloud resources.
Detects network activity initiated by the WinSCP utility, or DNS queries and HTTP requests directed toward easyupload.io, a common file-sharing site. This behavior may indicate an adversary staging or exfiltrating data to an external, potentially unauthorized location.
Page 618 of 1168