Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances of the systemd-userdbd process executing from non-standard file paths or general systemd-related processes launching from world-writable or temporary directories (e.g., /tmp, /dev/shm, /var/tmp, /home). This behavior is often indicative of process masquerading or a persistence mechanism where an adversary attempts to execute a malicious binary by mimicking system service naming conventions.
This rule detects various techniques used by an adversary to clear, truncate, or delete system and audit logs to hide their activity. It monitors for commands targeting Windows Event Logs (wevtutil, Clear-EventLog), Linux system logs (/var/log/ via rm/shred), and journalctl vacuuming, as well as the deletion of .evtx files. It further enriches these detections by identifying if the process was spawned by suspicious parent processes often associated with remote access, lateral movement, or command-and-control activity.
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Detects common Windows User Account Control (UAC) bypass techniques involving the execution of auto-elevating binaries, the use of PowerShell to launch processes with explicit 'RunAs' verbs, and unauthorized modifications to registry keys within HKCU\Software\Classes.
Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
Detects file creation, modification, or renaming events affecting the 'config.db' file within the Microsoft Desktop App Installer package directory. This file is used by the AppInstaller process and unauthorized modification may indicate attempts to tamper with installed applications or app installation settings.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
Detects unauthenticated requests directed at ServiceNow Scripted REST Resource endpoints, specifically targeting path segments like '/api/now/related_list_edit/create' or general '/api/now/' paths. The rule looks for transaction activity identified as 'Guest' user or lacking necessary authorization headers, potentially indicating exploitation of ServiceNow platform vulnerabilities.
Page 631 of 1168