Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of the '\adprinterpipe' named pipe by a process other than authorized AnyDesk binaries. This activity is indicative of a local privilege escalation (LPE) technique where an attacker pre-creates the pipe to impersonate the AnyDesk service and intercept a SYSTEM-level token.
Detects the unauthorized addition or peering of rogue devices within a Cisco SD-WAN fabric. This rule monitors vManage and vBond logs for successful peering or registration events that correlate with known rogue indicators, such as certificate validation failures, mismatching system information, or untrusted peer identities. This activity is often indicative of attackers attempting to gain persistent control over the SD-WAN infrastructure, potentially using authentication bypass vulnerabilities or stolen credentials.
Detects high-volume, suspicious enumeration of HR and Payroll related information via Microsoft Graph API. The rule identifies anomalous behavior such as rapid bulk pagination, usage of suspicious user agents, and specific targeting of sensitive fields (e.g., department, job title) or keywords commonly associated with HR and financial data, likely indicating the use of a stolen OAuth token.
Detects PowerShell executing Base64-encoded commands, often used by malware like Potemkin Loader (ClickFix payload), to evade basic string matching. The detection specifically looks for PowerShell processes initiated by explorer.exe with a command line containing a Base64-encoded string.
Detects modifications to Windows 'Run' registry keys where the referenced executable path is located within the 'AppData\Roaming' directory. This pattern is commonly used by malware and unauthorized persistent agents to masquerade as legitimate system processes like 'svchost.exe', 'MsEdgeUpdate.exe', or 'rcsdriver.exe' to maintain persistence upon user logon.
Detects anomalous outbound proxy requests to TON blockchain API endpoints (tonapi.io or toncenter.com) attempting to call the 'get_domain' method. This behavior is associated with the TONResolver RAT, which uses a specific, hardcoded smart contract address to dynamically resolve its C2 server hostname, effectively bypassing static domain-based security filters.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes executing from potentially suspicious or non-standard locations (Temp, AppData, ProgramData), excluding the legitimate Telegram Desktop client. This pattern is commonly observed in Remote Access Trojans (RATs) such as the Millenium RAT and other malware families utilizing Telegram as a C2 channel.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
This rule detects the creation of executable files within specific directories in the user's AppData Roaming profile, specifically matching patterns associated with known persistence or malicious staging filenames (xwreg or xgdf). This location is frequently abused by attackers to store persistent payloads that execute outside of standard program directories.
Detects inbound HTTP POST requests directed at the /SDK/webLanguage path, which is known to be vulnerable to command injection via CVE-2021-36260 in Hikvision IP cameras.
Page 621 of 1168