Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,575 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
Detects instances where AI coding agents, specifically Claude or Node-based environments, initiate secondary processes like git clone, package installation (pip, npm), or script execution. This behavior often suggests the agent is autonomously pulling and executing code from external repositories without explicit human approval, posing a significant risk of supply chain compromise.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.
This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).
Detects instances where a non-root user executes the 'sudo' command in combination with 'tee'. This pattern is frequently used to bypass file permission restrictions by appending or writing content to sensitive system files that would normally require root privileges, a common method for privilege escalation or maintaining persistence.
This rule detects the modification or creation of sensitive Linux files often used for persistence, such as cron job configurations, system boot scripts, and custom system tools. It monitors for file writing and process execution events involving specific paths and filenames identified as associated with persistence mechanisms or monitoring tools.
This rule detects potential persistence via Windows Registry Run keys by monitoring for the creation or modification of values pointing to suspicious paths (e.g., AppData, Temp, winupdate.exe). It also identifies suspicious execution of files originating from user-writable directories, specifically looking for indicators of PyInstaller-packaged executables or specific known malicious hashes, which are frequently used by adversaries for malware deployment.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects the use of the Windows 'netsh.exe' utility to perform network port proxying or tracing configurations, initiated by common command-line shells (cmd.exe, powershell.exe). Attackers may use these capabilities for lateral movement, persistence, or to sniff network traffic.
Page 627 of 1168