Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,578 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized or suspicious modifications to critical Linux configuration directories (e.g., cron, rc, init, ipsec) or specific application-related paths by processes not typically associated with system management or package maintenance. The rule further elevates risk when specific indicators like LD_PRELOAD, LD_LIBRARY_PATH, or known malicious string artifacts are present in the command line or file path.
Detects potential malicious persistence mechanisms (scheduled tasks, WMI event subscriptions, or Registry Run keys) initiated by Python executables or PyInstaller-bundled processes. This behavior is associated with information stealers that use these methods to maintain presence on a compromised host.
Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects the execution of wermgr.exe from a non-standard directory, specifically targeting the RoguePlanet junction-hijacking technique where the Windows Error Reporting process is replaced by an attacker-controlled binary under a staging path (e.g., %TEMP%\RP_*).
Detects signs of the VerdantBamboo threat actor's BRICKSTORM/PLENET campaign, specifically targeting Linux-based edge appliances like pfSense and Synology NAS. The rule monitors for sudo abuse by specific service accounts (e.g., egnyteservice, www-data) attempting to leverage NOPASSWD sudo privileges for the 'tee' utility to write malicious content into sensitive system files (e.g., /usr/sbin/, /etc/cron.d/, /etc/sudoers). Additionally, it identifies unauthorized sudo enumeration commands that may indicate early-stage reconnaissance or persistence efforts.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
Detects unauthorized non-browser processes accessing Chrome Local State, Cookies, or Login Data files. This activity is indicative of credential harvesting by infostealers, such as the Glove Stealer/Yuta campaign, attempting to bypass App-Bound Encryption (ABE) by accessing browser configuration and data stores.
Detects persistence attempts via modifications to Windows Registry Run keys, either through direct registry operations or via the execution of 'reg.exe'. It specifically flags suspicious registry value data (e.g., paths in Temp or AppData) and instances where non-standard binaries are utilized to perform these operations.
Detects indicators of ransomware-related anti-forensic behavior, including the deletion of Volume Shadow Copies via vssadmin or wmic, disabling system recovery via bcdedit, and the clearing of Windows event logs via wevtutil or system event log clearing events.
Page 645 of 1168