Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of the Microsoft IIS administrative tool, appcmd.exe, to uninstall ModSecurity WAF modules. This activity is a known technique used by adversaries to impair security defenses during post-exploitation, specifically observed in campaigns targeting ColdFusion servers.
Detects suspicious child processes spawned by AI coding agents that are potentially indicative of an indirect prompt injection attack. The rule specifically looks for the execution of 'axiom init' or 'pip install' commands, which are often used by attackers to execute malicious code within an environment when tricked by instructions embedded in repository files.
Detects unauthorized or suspicious attempts to access the memory space of the Local Security Authority Subsystem Service (LSASS) process. The detection logic looks for specific access masks typically used by Mimikatz (0x1010 and 0x1fffff) or execution attempts from binaries renamed to mimic common Mimikatz naming conventions (g.com, hs.com, dump.com). This is intended to identify credential dumping activities.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects web browsers or file explorer spawning common script interpreters (PowerShell, CMD, mshta, etc.) with command-line arguments indicative of malicious activity, such as encoded commands, Base64 strings, or web-based script downloads, typical of ClickFix or similar browser-based social engineering attacks.
Detects the use of PowerShell .NET reflection to access non-public static fields within the System.Management.Automation.AmsiUtils class. Attackers often target fields such as 'amsiInitFailed' or 's_amsiContext' to programmatically disable or bypass Antimalware Scan Interface (AMSI) inspection during script execution.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
This rule detects executions of 'winscp.exe' that are spawned by suspicious parent processes commonly associated with web servers or command interpreters (e.g., w3wp.exe, httpd.exe, powershell.exe). It also flags instances where WinSCP is invoked with command-line arguments indicative of automated scripts, custom configuration files, or remote transfer protocols (SFTP/SCP/FTP), which may indicate data staging or exfiltration activities.
This rule detects attempts to clear Windows Event Logs using either 'wevtutil.exe', PowerShell 'Clear-EventLog' command, or by monitoring specific Windows Event IDs (1102 and 104) which indicate logs have been cleared. Clearing event logs is a common technique used by attackers to hide malicious activity and evade detection.
Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Page 661 of 1168