Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects reflective process injection activity where the IntelAudioService.exe process opens a handle to the OneDrive.Sync.Service.exe process, potentially using XGU::Manager::ProcessReflector class methods to inject shellcode.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.
Detects instances where DllHost.exe creates or writes executable, script, or library files into common user-writable directories (e.g., C:\Users\*, C:\ProgramData\*, C:\Temp\*). This behavior is often associated with file staging or the delivery of malicious payloads. The rule also checks if the DllHost.exe process was spawned by WSL (Windows Subsystem for Linux) related processes, which can be indicative of cross-environment execution or evasion techniques.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects malicious .jse loader scripts associated with Kimsuky's NUKESPED malware family. The rule identifies suspicious behaviors including the creation of Scripting.FileSystemObject for filesystem manipulation, use of GetSpecialFolder for staging, and file system enumeration via GetFile, which are key components of the threat's payload delivery and staging process.
Detects the deletion of executable or script files (e.g., .dll, .exe, .bat, .jse) from temporary directories using common command-line utilities like cmd.exe or scripting hosts. This behavior is often associated with malware (such as Kimsuky loaders or JFMBackdoor) attempting to remove dropped artifacts to evade forensic analysis.
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Page 653 of 1168