Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
Detects suspicious command execution patterns (such as PowerShell encoded commands, IEX, or cmd.exe) being stored or accessed within the Windows Registry 'TypedPaths' key, which is used by Windows Explorer to track recently accessed paths. Adversaries may attempt to use this location to execute payloads via user-triggered interactions.
Detects a suspicious command-line chain where 'cmdkey' is used to add credentials, followed by the execution of 'regsvr32' targeting a DLL file hosted on a remote UNC path. This pattern is commonly associated with ClickFix or FileFix techniques where an adversary attempts to force authentication and execute malicious code via proxy execution.
Detects the creation of a scheduled task using either the 'schtasks.exe' utility or PowerShell's 'Register-ScheduledTask' cmdlet where the task configuration is pulled from an XML file located on a remote network share or HTTP/HTTPS resource. This pattern is commonly used by adversaries to facilitate persistence or lateral movement by remotely deploying tasks.
Detects suspicious command-line fragments being written to the Windows RunMRU registry key, which is used by the Explorer 'Run' dialog to store history. Adversaries may abuse this by injecting malicious command lines that are then executed when a user attempts to run a program.
Detects instances where Windows Explorer launches command interpreters (cmd.exe, powershell.exe, wscript.exe, or mshta.exe) with suspicious leading whitespace in the command-line arguments. This behavior is often associated with obfuscation techniques intended to bypass command-line monitoring or security filters.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task configuration is fetched from a remote XML file (HTTP/HTTPS URL). This pattern is often used by adversaries to download and execute malicious payloads via task scheduling, bypassing local file restrictions.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
FileFix loader chains abuse trusted code-hosting platforms like Bitbucket/GitHub to host staged payload components, exploiting domain trust to evade network detection.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Page 67 of 1168