Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by utilizing .NET reflection and IL generation. This technique involves creating dynamic methods and emitting instructions to manipulate the memory space of AmsiUtils, effectively disabling or blinding AMSI during script execution.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
Detects a potential exploitation of CVE-2026-12957, where a malicious git repository contains an MCP (Model Context Protocol) configuration file. When this workspace is opened, the Amazon Q Developer extension for VS Code improperly processes this configuration, resulting in the unauthorized execution of shell processes (cmd.exe, powershell.exe, bash, or sh) by the extension's host processes (code.exe or node.exe).
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
Detects WinRAR.exe writing files to sensitive directories such as the Startup folder or C:\ProgramData, potentially indicative of exploitation of path traversal vulnerabilities (CVE-2025-8088, CVE-2025-6218). This activity is associated with UAC-0226's use of WinRAR to establish persistence or stage malicious payloads.
Detects anomalous child process execution spawned by ImageMagick binaries. This pattern aligns with exploitation of ImageMagick vulnerabilities where Ghostscript delegates are hijacked via search order manipulation (PATH or working directory) to achieve arbitrary code execution.
Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects WinRAR application writing a shortcut (.lnk) file directly into the Windows Startup folder. This activity is indicative of exploitation of NTFS Alternate Data Stream (ADS) path traversal vulnerabilities (such as CVE-2025-8088 or CVE-2025-6218) to achieve persistence by placing a malicious shortcut in the user's startup directory without triggering typical user interaction warnings.
Page 626 of 1168