Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where legitimate, signed executables (specifically associated with Citrix, VMware, FortiGate, or Microsoft) load an unsigned DLL from the same directory as the executable. This pattern is indicative of DLL side-loading (Search-Order Hijacking), often used by attackers to gain persistence or mask malicious code execution under a trusted process. The rule excludes standard Windows System32/SysWOW64 directories to focus on non-standard, potentially attacker-controlled, file locations.
This rule detects DNS queries for the domain 'teledyneflir.com.de', which is known to be used by the threat actor UNC1549 as a fake recruitment portal to conduct phishing campaigns impersonating the Teledyne FLIR careers site.
This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.
This rule detects when a legitimate signed executable loads a DLL from a non-standard or user-writable directory (e.g., AppData, Temp, ProgramData). This behavior is characteristic of DLL search order hijacking, a technique used by various backdoors, including MiniJunk, to gain persistence or execution within a trusted process.
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects phishing emails containing specific Latin placeholder text artifacts, commonly generated by the Faker library, which are often indicative of unconfigured or template-based phishing kits embedded within email bodies or attachments.
Detects browser processes performing DNS resolution for Bing search endpoints immediately following access to M365 Copilot services within the same process storyline. This pattern is indicative of a SearchLeak exploitation chain where an adversary leverages M365 Copilot search to perform SSRF, using Bing as a proxy for data exfiltration.
Detects unauthorized processes querying specific Internet Explorer security registry keys that are typically only accessed by legitimate web browsers. LegionLoader and similar malware strains use these registry queries to identify sandbox or virtualized environments before executing malicious payloads.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).
Page 623 of 1168