Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,581 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects LegionLoader-like behavior where msiexec.exe creates a temporary MSI file in the system temp directory and subsequently executes it using the msiexec command line utility, a pattern often used to proxy malicious payload execution while evading detection.
Detects anomalous bulk data access activity within SharePoint or OneDrive where the Microsoft Copilot application is the primary interface. This activity pattern is consistent with SearchLeak-style organizational permission abuse, where an AI assistant may be used to discover and access a large number of distinct files that a user might not otherwise access manually.
This rule detects common Windows processes (msiexec, cmd, dllhost, or rundll32) attempting to detect the presence of a debugger by calling 'IsDebuggerPresent' or 'SetUnhandledExceptionFilter' within their call stack. This behavior is often associated with malware or malicious tools attempting to evade dynamic analysis in sandbox or debugged environments.
Detects the execution of 7z.exe with specific command line arguments that include references to 'data.dat' and 'Traiolx Custom Utils', which may indicate the use of 7-Zip for staging or archiving collected data for exfiltration.
Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.
Detects the use of PowerShell to silently download and install a Remote Monitoring and Management (RMM) tool, identified by common RMM executable names and silent installation parameters.
Detects the loading of the 'avicap32.dll' library or references to it in command lines by specific processes (hfy.exe, tcc.exe) associated with the BeepRAT malware family, indicating potential unauthorized webcam access.
This rule detects the creation of Amazon Q Model Context Protocol (MCP) configuration files, identified by 'mcp.json' in specific directories. It additionally correlates this file creation event with concurrent Git operations (checkout, merge, pull, or fetch) performed by a user, flagging the activity as a higher risk signal if both conditions are met.
Detects network communication associated with BeepRAT malware, specifically targeting hardcoded TCP connections to destination port 18848 and ICMP packets containing the string 'BEEP', which are used for C2 communication and keepalive signals.
Detects the execution of the process HFY.exe combined with command-line arguments indicative of screen capture, thumbnail generation, or webcam access. This behavior is consistent with reconnaissance or information gathering activities.
Page 666 of 1168