Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
Detects non-privileged execution of system commands (sysctl, freebsd-version, uname) used to query kernel parameters and system configuration. These actions serve as reconnaissance prerequisites for exploiting the BUMSRAKETE (CVE-2026-45257) local privilege escalation vulnerability on FreeBSD systems.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Detects execution of the RustDesk remote access tool from non-standard, user-writable directories, or when spawned by suspicious parent processes such as shells or scripting hosts. This rule is designed to identify unauthorized use of RustDesk as a persistence or remote access mechanism by adversaries attempting to bypass standard software management.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
Detects Node.js processes accessing common shell history files (e.g., .bash_history, .zsh_history, PowerShell history). Such behavior is often indicative of credential harvesting or post-exploitation reconnaissance activity, specifically where a Node.js runtime environment is being leveraged to read sensitive user activity logs.
Detects modifications to Windows Run or RunOnce registry keys by PowerShell or Reg.exe processes, specifically when originating from the WinGet DSC (Desired State Configuration) stack. The rule flags entries where the registry value points to potentially sensitive/user-writable directories or contains evidence of encoded command execution (e.g., PowerShell base64 encoding or common obfuscated syntax).
Detects the creation of new Windows services through suspicious or unexpected process chains. This includes services spawned by WinGet/DSC components, services created by sc.exe where the process path points to user-writable directories (e.g., Temp, AppData, User profiles), or system event logs (Event ID 7045) indicating service installation from non-standard locations. This rule is designed to identify potential persistence mechanisms or privilege escalation attempts involving unauthorized service creation.
This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.
Page 678 of 1168