Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,341 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of bash commands that contain base64 decoding flags, typically used to obfuscate command-line arguments to evade detection, initiated from a terminal application.
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Detects potential vishing activity associated with the Sauron Loader threat. The rule identifies a pattern of a mailbox receiving a high volume of inbound emails (spam or subscription bombs) within a short window, followed by the user launching remote assistance tools like Quick Assist or AnyDesk on the same endpoint, indicating an attacker-guided remote session.
Detects suspicious execution patterns on macOS where the Terminal application launches a bash process executing base64-encoded commands. This behavior is indicative of the ClickFix campaign, where users are prompted to copy and paste malicious obfuscated scripts into the terminal, often under the guise of a reCAPTCHA verification.
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
Detects the creation, update, or activation of an external Identity Provider (IdP) or federated trust configuration within the Okta environment. This activity may indicate an attempt to establish a rogue federation trust, which allows an adversary to perform cross-tenant impersonation and authenticate as any user by minting assertions signed by attacker-controlled keys.
Detects anomalous OAuth application consent activity by identifying a surge in unique users granting permissions to a single OAuth application within a short timeframe. This behavior is indicative of consent phishing campaigns where attackers lure users to grant application access to malicious apps, effectively stealing application access tokens and gaining persistent access to resources without requiring the victim's password.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Page 68 of 1168