Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects high-frequency network requests from a single process to potentially sensitive targets such as cloud metadata services (169.254.169.254, metadata.google.internal) or using URL traversal patterns (../, %2e%2e, %2f). This behavior is characteristic of Server-Side Request Forgery (SSRF) attempts, where an attacker tries to access internal resources by forcing an application to make unauthorized requests.
Detects potential payload staging activities within a WSL2 environment where a process writes an executable or script to the Windows filesystem using the DllHost.exe (COM Surrogate) proxy. This rule uses process activity on the host to infer the presence of a WSL2 environment (wsl.exe or vmmem) and analyzes the absence of Windows-native network events, which is a characteristic pattern of WSL2-based network activity being hidden from Windows host telemetry.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup targeting critical Active Directory or system configuration files (ntds.dit, SYSTEM, or SECURITY registry hives). This behavior is often associated with credential dumping, where adversaries attempt to extract the AD database by utilizing built-in Windows backup tools to create a copy that can then be exfiltrated or processed offline.
Detects the creation or modification of Exchange Online inbox rules that either contain specific sensitive keywords (e.g., payroll, bank, direct deposit) or perform actions that hide, delete, or move messages. This behavior is commonly used by attackers to intercept sensitive communications or conceal evidence of their presence in a compromised mailbox.
Detects the execution of the suspicious binary 'AdgNsy.exe', including scenarios where it is spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is often associated with malicious activity, including potential persistence mechanisms or arbitrary code execution via WMI event subscriptions.
Detects signs of Adversary-in-the-Middle (AiTM) phishing where a login attempt produces a reprocess error (50199) or result code 90014, immediately followed by suspicious activity using specific Firefox user-agent versions known to be associated with Tycoon 2FA reverse proxy session token capture tools.
Detects browser extension renderer processes (Chrome or Edge) performing virtualization, sandbox, or debugger evasion checks. This is achieved by monitoring for suspicious WMI queries to discover virtualized environments, access to registry keys associated with virtual machine guest additions, and the loading of DLLs related to VM guest support tools.
Detects anomalous network activity from browser renderer subprocesses (chrome.exe/msedge.exe) correlated with concurrent file system access to sensitive browser credential stores (Login Data/Cookies). The rule identifies high-frequency outbound connections following or occurring during access to these files, which is a common indicator of credential exfiltration performed by malicious browser extensions or injected scripts.
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Page 681 of 1168