Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspicious sequence of events where a file with an architecture-specific name (often associated with botnet payloads like JDY/KV-botnet) is created, executed, and deleted within a 60-second window. This behavior is indicative of transient malicious payloads executing and self-removing to evade detection.
This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Correlates the ClickFix PowerShell execution with the dropping of the Potemkin loader executable and its associated configuration files into the AppData folder.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects the deployment of AdaptixC2 agents by monitoring for suspicious rundll32.exe process executions indicative of reflective DLL injection. This includes rundll32.exe loading DLLs from suspicious directories (Temp, AppData, ProgramData) with potential reflective loader flags or exported functions, often triggered by parent processes like msiexec.exe or consent.exe. The rule also monitors for direct outbound network connections from rundll32.exe to known AdaptixC2 command-and-control infrastructure.
Detects potential SSH reverse tunneling or SOCKS proxying, often used by threat actors like Akira or associated with Bumblebee loaders, to establish persistent C2 channels. The rule monitors process execution of plink.exe and ssh.exe with suspicious arguments (e.g., -R, -D, -N), network connections to known malicious C2 IP addresses, and SSH tunnel processes running as SYSTEM or spawned by non-interactive service-related processes.
Detects potential exploitation of Firefox SmartWindow (CVE-2026-20253) involving token exfiltration via specific URL patterns, unauthorized configuration preference tampering (e.g., smartwindow.enabled, smartwindow.apiKey), or modifications to browser configuration files (prefs.js, user.js) by the Firefox process.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
This rule monitors for file and process events associated with known malicious Chrome extensions. It filters for specific extension IDs embedded within file paths or command-line strings, which typically indicate the installation or activity of malicious browser plugins.
Page 655 of 1168