Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the loading of the 'nvdaHelperRemote.dll' library by potentially unauthorized or suspicious executable processes, including 'Mixed Reality.exe' and 'COU_ITR-1_to_4_AY2026-27.exe', or when it is loaded from an unexpected path such as a Windows Media Player directory. This pattern is indicative of DLL side-loading or masquerading techniques.
Detects unauthorized access, copy, or read operations against Chromium-based browser cookie database files by processes other than standard browsers. This behavior is indicative of session hijacking, a technique observed in malware like TONResolver and Millenium RAT to extract authentication tokens for subsequent adversary-in-the-middle or session theft attacks.
This rule detects potential credential harvesting activities by monitoring for suspicious environment variable enumeration or unauthorized access to sensitive credential and configuration files (such as AWS credentials and .env files) by common command-line utilities. It is designed to identify post-compromise reconnaissance where an adversary attempts to extract cloud provider or AI API keys.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
Detects instances where the Windows Installer (msiexec.exe) spawns a command prompt (cmd.exe) to execute specific batch files or custom scripts, which is a technique often used for malicious proxy execution.
Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.
Detects potential SearchLeak (CVE-2026-42824) prompt-to-parameter injection in Microsoft 365 Copilot Enterprise. The rule monitors for search operations containing URL-encoded characters, HTML/JS injection payloads, or anomalous long query strings that indicate a malicious attempt to influence search results or exfiltrate data.
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
Detects LegionLoader malware activity involving the creation of known-malicious DLLs (7z.dll, normaliz.dll, msvcr90.dll) or the malicious batch script 'xupdate.bat' within non-standard subdirectories of AppData\Roaming. This behavior is indicative of DLL sideloading used to maintain persistence or execute malicious payloads.
Detects the execution of Control Panel applets (.cpl) via unconventional proxy binaries like dllhost.exe or rundll32.exe. This pattern is commonly observed in malware attempting to execute malicious DLLs by leveraging Windows system binaries to bypass security controls and application whitelisting.
Page 640 of 1168