Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.
Detects potential UAC bypass or COM hijacking activities by monitoring for anomalous process spawning patterns from Windows auto-elevating binaries (e.g., eventvwr.exe, fodhelper.exe, sdclt.exe) or suspicious child processes spawned by DllHost.exe from user-writable directories.
Detects instances where browser processes (msedge.exe, chrome.exe) copy sensitive credential and session SQLite databases (e.g., Login Data, Cookies) to locations outside of the canonical User Data directories. This behavior is indicative of the StegoAd campaign, where malicious browser extensions stage these files for subsequent exfiltration.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
Page 657 of 1168