Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.
This rule detects techniques commonly used by attackers to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. It monitors for the execution of known Mimikatz binaries or the use of specific Mimikatz command-line arguments, the execution of legitimate tools like Procdump to dump LSASS memory, the misuse of rundll32 with comsvcs.dll to perform a memory dump, and the creation of files named lsass.dmp, which are common artifacts of credential dumping activities.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects the use of native Windows commands 'net.exe' and 'net1.exe' to perform domain group or user enumeration, as well as the execution of 'ADExplorer.exe' (a known tool for viewing and editing Active Directory objects). These activities are commonly associated with the reconnaissance phase of an attack to map network infrastructure and identify privileged accounts.
Detects the execution of common Windows system utilities (tasklist.exe, sc.exe, reg.exe, wmic.exe, powershell.exe) with command-line arguments indicative of security software, antivirus product, or system service enumeration. This activity is frequently associated with reconnaissance efforts by threat actors attempting to identify defensive capabilities.
Monitors successful sign-in events that utilize the OAuth 2.0 Device Code authorization protocol. While legitimate for headless applications or IoT devices, this flow is frequently abused by attackers for credential harvesting and phishing attacks to gain unauthorized access to user accounts and cloud resources.
Detects unauthorized HTTP requests to Gitea containing an 'X-WEBAUTH-USER' header set to 'admin'. This targets CVE-2026-20896, where a misconfigured reverse proxy trust setting allows external users to spoof authentication and gain administrative privileges.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Detects execution of Mimikatz or usage of common tools like Procdump to dump LSASS memory. The rule monitors for characteristic command-line arguments, renamed binary names associated with Mimikatz, and the extraction of sensitive credentials to output files.
This rule detects the creation of executable script files (.aspx, .php) within the webroot images directory or identifies known specific filenames associated with web shells. This behavior is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a web server.
Page 637 of 1168