Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,581 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the loading of 'nvdaHelperRemote.dll' or 'nvdaHelper64.dll' by any process other than 'nvda.exe', or when loaded from outside the legitimate NVDA installation directory. This pattern is commonly used in DLL sideloading attacks to execute arbitrary code, as observed in Operation DragonReturn.
Detects the TonRAT malware establishing persistence by modifying Windows Run or RunOnce registry keys. The rule specifically monitors for registry value creation or modification triggered by scripting or runtime host processes such as node.exe, bun.exe, wscript.exe, or cscript.exe, when the referenced persistence path points to locations commonly used for malicious payloads, such as AppData, ProgramData, or Temp directories, or involves JavaScript files.
Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.
Detects unauthorized executables masquerading as XDR agents (Palo Alto Networks) or VMware tools (XDRAgent.exe, vmtools.exe, vmwared.exe) by executing from suspicious directories such as AppData, Temp, or ProgramData\VMware instead of authorized installation paths. This technique is often used to hide the execution of malicious tools like reverse tunnel clients or VPN utilities.
Detects the initialization of unprivileged user and network namespaces combined with specific IPsec tunnel configurations (xfrm/esp/veth). This sequence of operations is a known prerequisite for exploiting the DirtyClone (CVE-2026-43503) vulnerability, a Local Privilege Escalation (LPE) in the Linux kernel.
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects exploitation attempts against CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies suspicious HTTP POST requests directed at specific vulnerable API endpoints, looking for common Python code injection payloads (e.g., 'os.system', '__import__', 'subprocess') or the presence of a known dropper payload ('isp.sh') within the URI query. It also flags requests originating from common automation user agents like 'python-requests'.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
This rule detects the use of the native Windows 'tar.exe' utility to extract a ZIP archive into an AppData staging path. This behavior is associated with the Potemkin Loader, which downloads a ZIP payload and then silently extracts it. The rule specifically looks for 'tar.exe' being executed with the command-line arguments '-xf' followed by a ZIP file and '-C' followed by a path containing 'AppData'.
Page 663 of 1168