Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects web proxy traffic containing links to lookalike recruitment portals using specific typosquatting suffixes (e.g., .com.de) and URL paths (/careers/auth). These patterns are linked to UNC1549, an adversary identified as targeting aerospace and defense organizations with fake React-based recruitment lures.
Detects the creation of new scheduled tasks using the Windows schtasks.exe command-line utility. This behavior is commonly used by adversaries for persistence by ensuring malicious payloads, loaders, or backdoors are re-executed upon system events or intervals.
Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.
Detects unauthorized access to browser-based credential storage files (such as Login Data and cookies) by processes other than recognized browser executables. This behavior is indicative of credential theft or dumping attempts, often performed by malicious software to exfiltrate saved passwords and session cookies.
Detects instances where PowerShell is spawned by cmd.exe and includes command-line arguments indicative of a reverse shell, such as network socket creation, hidden execution, or encoded commands. This pattern often follows suspicious parent processes or activities such as keystroke injection.
Detects the modification of Windows Registry 'Run' keys using the command-line utility 'reg.exe'. This technique is commonly employed by adversaries to establish persistence, ensuring that malicious code, such as the MiniJunk backdoor, executes automatically upon system login.
Detects the execution of the Windows HTML Help executable (hh.exe) to open a Compiled HTML Help (.chm) file. The rule specifically monitors for known indicators associated with Kimsuky, including the 'Review.chm' lure name and a specific file hash identified in threat intelligence reporting as part of a multi-stage attack involving decoy content.
Detects the use of 'docker cp' to copy files out of a container to the host filesystem. This rule identifies suspicious patterns that may exploit the path traversal vulnerability CVE-2026-43503, which allows an attacker to escape the intended destination directory on the host.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
Page 659 of 1168