Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,576 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of schtasks.exe originating from Windows system management or package management server processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This activity may indicate administrative task automation or potentially malicious persistence and execution attempts using legitimate system binaries.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
Detects incoming web requests to GCP Cloud Run services that exhibit patterns associated with Server-Side Request Forgery (SSRF) exploitation. The rule monitors for URLs containing GitHub blob paths combined with path traversal sequences ('//') that point to sensitive internal system paths such as /proc/, /etc/, or /var/task/.
This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
Detects JFMBackdoor malware performing process enumeration and network connection discovery. The rule triggers when fltMC.exe exhibits suspicious behavior, specifically invoking API functions such as CreateToolhelp32Snapshot, Process32First/Next (process enumeration) or GetExtendedTcpTable/UdpTable (network discovery), which is indicative of sideloading malicious DLLs (FLTLIB.dll) into the legitimate fltMC.exe process context.
Detects the execution of a potentially malicious fltMC.exe from the user's TEMP directory, a technique utilized by the Red Lamassu actor to sideload the JFMBackdoor. This rule monitors for known malicious file hashes or the execution of fltMC.exe from suspicious locations where the legitimate System32 binary should not reside.
This rule detects potential beaconing or re-registration activity associated with the JDY/KV-botnet by monitoring network connections to known Tor control/relay ports (9001 and 9050). The detection identifies endpoints making high-volume, multi-destination connections to external IPs over these specific ports, a pattern indicative of botnet nodes attempting to re-establish C2 communication after infrastructure disruption or actively recruiting new nodes.
Detects the execution of suspicious Windows native processes spawned directly by wsl.exe. Attackers leverage WSL2 interop functionality to execute Windows-native binaries from within a Linux environment, using the wsl.exe process tree to obscure their activities and stage payloads.
Page 632 of 1168