Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects incoming emails containing suspicious legal-themed subjects (e.g., subpoenas, copyright infringement) from Gmail domains that include shortened URLs (e.g., bit.ly, goo.gl). The rule also checks for successful SPF or DKIM authentication results, which are common in mass phishing campaigns to bypass initial spam filters.
Detects potential phishing campaigns by identifying bulk inbound emails sent to generic recipient aliases (e.g., info@, support@) or to empty recipient fields, combined with subject lines referencing urgent legal or compliance matters (e.g., lawsuits, subpoenas, copyright infringement). The rule uses statistical analysis to flag high-volume emails and correlates them across shared body content patterns to identify coordinated mass-mailing campaigns.
Detects the initialization phase of the Operation DragonReturn DcRAT loader, specifically identifying the creation of a unique named global mutex (Global\ShitSetupOn26126k) which acts as a single-instance enforcement mechanism and is often associated with sandbox evasion techniques.
Detects the execution of a malicious Node.js payload by the TONResolver malware. The rule monitors for the execution of node.exe from a specific path within the user's AppData directory (AppData\Local\Nodejs\node-v24.13.0-win-x64\) when accompanied by a JavaScript file argument, indicating the execution of a remote access trojan (RAT) script.
Detects the execution of 'whoami' via 'cmd.exe' where the parent process is not a standard Windows system process or a known application path. This pattern is often indicative of reconnaissance or post-exploitation activity where an attacker attempts to identify the current user context.
This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.
Detects Millenium RAT writing captured keystrokes to specific obfuscated file paths or staging files. This behavior includes the creation of keylogger output files within a uniquely named AppData subdirectory (GTR1YB4A7s) or a temporary staging file (C:\debug.txt), which are artifacts used by the RAT before data exfiltration.
Detects DLL sideloading behavior where 'Mixed Reality.exe' loads the 'nvdaHelperRemote.dll' library from the Windows Media Player directory, rather than the legitimate NVDA installation path. This is a characteristic indicator of the Silver Fox threat activity associated with Operation DragonReturn.
Detects cross-process injection attempts into the Windows system process 'svchost.exe' where the source process is either unsigned or lacks a verified Microsoft publisher. This pattern is commonly observed in malware payloads, such as DcRAT, attempting to hide malicious activity within a legitimate system process.
Detects the WinRAR.exe process creating a .lnk shortcut file within the user's Startup directory. This behavior is indicative of an exploitation attempt (e.g., UAC-0226 related NTFS path traversal vulnerabilities) where an attacker plants a persistence mechanism via a malicious archive extraction.
Page 639 of 1168