Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound requests to the Bing 'searchbyimage' endpoint where the 'imgurl' parameter points to an external (non-trusted) domain. This pattern is indicative of potential SSRF exploitation, such as the described SearchLeak (CVE-2026-42824) vulnerability chain, where an attacker uses Bing's search functionality as a proxy to reach internal or restricted infrastructure.
Detects suspicious process activity, module loading, and function calls indicative of the BeepRAT malware family. The rule monitors for keyboard hooking via SetWindowsHookEx, the presence of specific keylogger-related command-line arguments, and the execution or loading of files associated with BeepRAT lure binaries.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
Detects high-frequency registry access (more than 50 events in a 1-minute window) by processes executing from common temporary, user-profile, or writable directories (e.g., AppData, Temp). This behavior is often associated with malware activity, such as credential dumping, persistence installation, or configuration modification.
Detects SystemBC (Coroxy) malware attempting to establish persistence by writing to Windows Registry Run or RunOnce keys. The rule specifically monitors for registry value names associated with 'socks5' proxy functionality, the presence of 'stmbc.exe' in registry data, or hidden PowerShell command strings often used by the malware for execution.
Detects the presence of BeepRAT-related shellcode loader files (config.ini.c or temp.bin) located within a TCC (Tiny C Compiler) directory. These artifacts contain specific shellcode for hash-based API resolution, a technique used to dynamically resolve Windows API functions like LoadLibraryA and GetProcAddress to evade static analysis.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
This rule identifies network activity or DNS queries associated with the known malicious domain 'perplexity-ai.online'. It monitors both endpoint network event logs and DNS logs to alert on any attempts to establish communication with or resolve this specific domain.
Page 641 of 1168