Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects network connections to specific cloud service providers (Google Cloud PubSub/MQTT, Azure Service Bus) or common STUN/WebRTC ports (3478) initiated by processes other than standard web browsers or common communication applications.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
Detects instances where an executable loads a dynamic-link library (DLL) from its own directory, specifically focusing on files with 'minibrowse' or 'minijunk' in the path. This pattern is commonly used in DLL side-loading or directory-based hijacking to ensure that a malicious library is loaded instead of the intended legitimate library.
The rule identifies potential network scanning or probing activity by detecting a high frequency of network connection attempts (3 or more within a 1-minute window) directed at a specific remote port, 1313. This port is often associated with non-standard services or custom applications and may indicate reconnaissance or unauthorized service discovery.
Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
This rule detects the execution of a process named 'sightgrab.exe' or the creation of suspicious JPG files within the 'C:\Users\Public\Videos\' directory. This activity is indicative of credential or data harvesting tools, often used to capture screenshots or sensitive user data, followed by staging the captured files in public-accessible folders.
Page 658 of 1168