Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,577 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potentially malicious spearphishing emails containing suspicious file types (such as executables, scripts, or archives) that are sent with either a spoofed sender domain or a subject line containing common lures targeting IT/infrastructure teams. It focuses on identifying high-risk email deliveries that indicate social engineering and initial access attempts.
Detects Microsoft Graph API enumeration of privileged directory endpoints using a token with only User.Read scope and password-only authentication (amr: pwd). This activity is consistent with the exploitation of CVE-2025-0309, often associated with tooling like AzureHound/roadtx, which abuses hidden Conditional Access exclusion policies.
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
Detects suspicious modifications to GitHub Actions workflows, such as unauthorized file overwrites, commits by bot impersonation identities (e.g., dependabot, renovate), or the upload of sensitive artifacts like 'format-results.txt'. These activities are indicative of IronWorm-style attacks targeting CI/CD pipelines to exfiltrate secrets via build artifacts.
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects suspicious behavior associated with ADNotificationManager.exe, including DLL side-loading of vcruntime140_1.dll, loading of DLLs from user-writable directories (potential DLL hijacking), and the spawning of Rclone.exe for potential data exfiltration via SFTP.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.
This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.
Page 647 of 1168