Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects rapid, multi-type API enumeration (GetCallerIdentity, ListBuckets, DescribeInstances) performed by an IAM principal or AssumedRole that has no historical record of performing these actions. This pattern is indicative of potential credential theft, specifically from compromised developer tooling such as malicious MCP configurations or automated agents like Amazon Q, Claude Code, Cursor, or Windsurf.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
This rule detects the execution of Docker containers or related CI/CD runner processes (like Gitea act_runner) with insecure configuration options. These options, such as --privileged, --pid=host, or mounting the Docker socket, can facilitate container escapes or unauthorized host-level access.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.
Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.
Page 642 of 1168