Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects multiple suspicious activities associated with the AnyDesk remote access application, including the creation of specific named pipes, execution of processes with sensitive command-line arguments (e.g., comsvcs, impersonation privileges), non-standard DLL loads by the application, and the spawning of system-level processes. These behaviors are indicative of abuse of remote access software for post-exploitation activities or privilege escalation.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
This rule detects potential persistence mechanisms by monitoring the creation of scheduled tasks using the 'schtasks' utility or modifications to Windows Registry 'Run' keys, specifically targeting suspicious paths (AppData, Temp, or ProgramData). The detection logic correlates these suspicious persistence artifacts with network activity by joining the events with Sysmon Event ID 3 (Network connection) to identify hosts communicating over common C2-associated ports (4000, 4001, 4002, 443) to non-private IP addresses. A risk score is calculated based on the presence of these persistence markers and outbound network connections.
Detects web server processes (e.g., PHP, IIS, Apache, Nginx) spawning suspicious child processes including shells (cmd.exe, powershell, bash) or network utilities (curl, wget, netcat), which is often indicative of webshell exploitation or post-compromise activity.
Detects potential container breakout or privilege escalation attempts originating from Gitea act-runner processes. The rule monitors for the execution of containers with dangerous security configurations (e.g., host PID/IPC namespace, privileged capabilities, disabled security modules) or the use of nsenter to break out of a container into the host environment.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
Detects anomalous Firefox behavior consistent with CVE-2026-20253 exploitation, including unauthorized modification of Smart Window browser preferences (e.g., enabling the feature or redirecting the API endpoint) and suspicious child process creation following potential URL exfiltration events.
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
This rule detects the execution of common command-line interface tools (such as PowerShell, cmd, wscript, and certutil) spawned by the SimpleHelp remote support binary ('simplehelp.exe'). It also monitors for specific network connections associated with the SimpleHelp infrastructure (IP 96.126.130.126 on port 58942) that may indicate remote support activity or misuse of the platform.
Page 669 of 1168