Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,582 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding an exclusion path. This activity is commonly used by adversaries to prevent security software from scanning specific directories where malicious tools or payloads are staged.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
This rule detects suspicious activity associated with the 'MixedSvc' service and potential DLL side-loading. It identifies the creation of a Windows service named 'MixedSvc' using sc.exe, the execution of 'Mixed Reality.exe' from a Windows Media Player directory, the side-loading of 'nvdaHelperRemote.dll' within the Windows Media Player directory, and the execution of svchost.exe with 'Mixed Reality.exe' as its parent/causality actor, which is indicative of malicious injection and persistence mechanisms.
Detects the TONResolver RAT attempting to resolve its Command and Control (C2) server address by querying TON blockchain API endpoints. The rule monitors network connections and DNS queries made by non-standard processes to known TON API infrastructure, specifically tracking potential dead-drop resolver behavior where smart contract data is used to obtain malicious infrastructure addresses.
Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.
This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.
Detects suspicious HTTP requests and API activity targeting Fortinet devices, specifically matching patterns associated with known vulnerabilities like CVE-2022-40684 and CVE-2024-21762. The rule monitors for unauthorized REST API calls, attempts to interact with sensitive administrative endpoints, and patterns indicating potential authentication bypass or remote code execution attempts on FortiGate, FortiOS, and FortiProxy appliances.
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
Page 664 of 1168