Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,580 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects potential UAC bypass attempts using COM surrogate (dllhost.exe) or MMC (mmc.exe) to spawn child processes from suspicious or user-writable locations like AppData or Temp. It also monitors for specific command-line artifacts associated with BeepRAT and other potentially malicious activity.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects processes running from suspicious temporary directories (e.g., AppData, Windows Temp) that load 'user32.dll' and subsequently create or write to log files in user or application directories. This behavior is highly indicative of keylogging, where malware hooks input functions via user32.dll and stores captured data in local log files for later exfiltration.
Detects the suspicious creation of executable files in C:\ProgramData with randomized paths, typically associated with the SystemBC backdoor. The detection rule correlates this file creation event with co-occurring suspicious activities indicative of ransomware operations, such as the creation of known ransomware-related files (e.g., decryptor notes) or signs of lateral movement via non-standard network traffic and SMB activity.
Detects various reconnaissance and discovery commands, including process listing, registry queries, and security software enumeration, that are characteristic of the SystemBC malware's in-memory scripting behaviors. The rule identifies suspicious process parent-child relationships, unauthorized registry queries of sensitive security paths, and the use of command-line tools like WMIC, Tasklist, and PowerShell for environment discovery without disk-based script artifacts.
Detects potential HTTP Request Smuggling via nghttpx, where an HTTP/1.1 Upgrade request containing a Content-Length header is followed by a subsequent request within a short time window on the same backend connection. This pattern indicates a potential attempt to route poisoned responses to a victim client reusing the keep-alive connection.
This rule detects activities related to the 'ipv6_extlen_wrap_probe' proof-of-concept (PoC) exploit, which targets IPv6 extension header vulnerabilities. The detection logic monitors for: 1. Execution of the PoC binary, 2. Compilation of the PoC source code using common compilers like g++ or MinGW, 3. Creation of files associated with the PoC, and 4. Nmap execution with specific flags indicative of an attempt to trigger the vulnerability via raw IPv6 scanning.
This rule detects activities related to the 'Exploitarium' DLX exploit proof-of-concept (PoC) toolkit. It monitors for the invocation of 'objdump' with specific flags used in these exploits, the presence of associated Python and shell scripts on the filesystem, and the spawning of suspicious child processes (like command interpreters or calculators) by 'objdump', which acts as an indicator of successful exploitation or exploit testing.
Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.
Page 667 of 1168