Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the exploitation or configuration manipulation of the Firefox browser.smartwindow.enabled feature, which can be abused by an attacker to exfiltrate sensitive browser data such as history, tab URLs, and secret query-string parameters to a remote endpoint. The rule monitors for network connections containing known exfiltration path signatures, connections to hardcoded PoC server addresses, or the modification of configuration settings related to the SmartWindow feature.
Detects attempts to perform container escapes by abusing the 'docker cp' command. The rule identifies path traversal sequences in 'docker cp' arguments, as well as unauthorized shell or script execution spawned by container daemon processes (e.g., dockerd, containerd) following a file copy operation, and specific file creation patterns indicative of a container escape attempt.
This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.
This rule detects the installation of a new Microsoft Edge extension followed by suspicious network activity from the msedge.exe process within 24 hours. The suspicious activity includes the fetching of common steganography-friendly file types (e.g., .png, .webp, .woff2, .conf) from known StegoAd C2 domains. This behavior is indicative of a malicious extension retrieving payloads hidden in legitimate-looking media files or beaconing to attacker infrastructure.
Detects the creation of .aspx files within common IIS web root directories (inetpub, wwwroot). The rule identifies potential web shell activity by monitoring for specific suspicious filenames (e.g., cmd, shell, upload, file) or by flagging any ASPX creation performed by processes not typically associated with legitimate web application deployments.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
Detects instances where the RustDesk application process launches suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe) that are not associated with legitimate administrative functions (like installation or service management). This pattern indicates potential exploitation of RustDesk session permission bypass vulnerabilities to execute arbitrary commands on a remote system.
Detects reconnaissance and post-exploitation activity associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability. The rule identifies the execution of known libpwn PoC binaries, libssh2-dependent client applications (curl, git, php) spawning unexpected shell processes, and unauthorized access to SSH-related configuration or key files by non-interactive processes.
Page 638 of 1168