Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,584 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects successful Microsoft 365 user authentications where Conditional Access (CA) policies were bypassed, resulting in single-factor authentication. This pattern is indicative of attackers using compromised edge network appliances—which are often configured as trusted network locations—to proxy authentication requests and circumvent security controls.
Detects SSH, SFTP, or SCP connections originating from internal edge appliances such as pfSense firewalls or Synology NAS devices directed at internal network hosts. This activity is consistent with VerdantBamboo BRICKSTORM lateral movement, where compromised edge infrastructure is leveraged as a pivot point to gain access to the internal network.
Detects the creation of specific file and directory structures under the %TEMP% directory associated with the RoguePlanet (CVE-2026-50656) exploit. The exploit utilizes a UUID-named directory prefixed with 'RP_' to stage components, including wermgr.exe and wdtest_temp, required for a junction swap attack against Microsoft Defender. The detection excludes known system processes that might access the temporary folder.
Detects memory patching operations targeting 'ntdll.dll', specifically aiming to disable ETW (Event Tracing for Windows) by modifying 'EtwEventWrite' or 'NtTraceEvent' functions. This activity is filtered to detect processes originating from PyInstaller-compiled binaries, identified by the use of '_MEI' temporary extraction directories or specific process names like 'winupdate.exe', which are commonly associated with malicious use of the PyInstaller framework.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
Detects the Yuta/Solara .NET WPF dropper (SLaunch.exe) executing the staging phase of a PyInstaller-compiled Python stealer (winupdate.exe) into the %APPDATA%\.cache directory, as observed in the Glove Stealer campaign.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
This rule detects the execution of Quick Assist (quickassist.exe) or Microsoft Remote Assistance (msra.exe) in scenarios where the parent process, causality chain, or command line includes references to Microsoft Teams. This behavior is indicative of social engineering attempts where attackers impersonate IT support via Teams to induce users to launch remote access tools, a tactic observed in campaigns like BlackBasta.
Page 673 of 1168