Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,583 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects a multi-stage activity chain where a user performs a git clone, followed by Visual Studio Code, Node, or Python spawning a shell or interpreter, which then initiates a network connection to known suspicious staging infrastructure. This behavior is indicative of a developer machine being compromised to exfiltrate code or download malicious payloads.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.
Detects the use of 'attrib.exe' to modify file attributes (specifically adding hidden or system attributes) on files with a '.dll' extension located in suspicious directories such as 'ProgramData', 'AppData', or other paths frequently used for persistence or file staging. This behavior is indicative of an adversary attempting to hide malicious artifacts.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects indicators of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks or suspicious kernel driver installations. The rule monitors for known vulnerable driver files being written to disk, unauthorized creation of .sys files in temporary directories, the installation of new kernel driver services via System Event ID 7045 (referencing temp paths or known malicious drivers), and the use of the sc.exe utility to create services with a kernel driver type.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
Specifically flags Invoke-WebRequest being launched directly from the Explorer shell context, bypassing normal script delivery to pull the Potemkin loader.
Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.
Page 671 of 1168