Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation of executable or PowerShell script files in common temporary or user-writeable directories by DllHost.exe within 120 seconds of the execution of wsl.exe. This behavior is indicative of potential payload staging where Windows Subsystem for Linux (WSL) might be leveraged to obscure or facilitate the delivery and execution of malicious artifacts.
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
Detects malicious shell script execution on Linux edge/IoT devices associated with the JDY botnet exploitation of CVE-2026-35616. The rule identifies processes checking for MIPS-based architectures, using download utilities (wget, curl) for payload retrieval, and subsequent file deletion activity indicative of post-exploitation cleanup.
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
Detects outbound network connections originating from the 'vmmem' process, which is the Windows host process managing the WSL2 virtual machine. Since WSL2 operates with its own network stack, connections from this process to non-local (non-RFC-1918) IP addresses can bypass traditional Windows host-based network telemetry, potentially indicating command-and-control (C2) activity or payload staging occurring within the WSL2 container environment.
Detects modifications to Windows Registry keys responsible for the 'open' command handler associated with 'exefile'. Adversaries often modify these registry keys to achieve persistence or execute malicious code whenever an executable is opened, by injecting commands or replacing the default handler.
Detects anomalous bulk configuration data collection from Cisco vManage via REST API endpoints typically used by UAT-8616. The rule identifies repeated HTTP GET requests to critical configuration, device, and system information endpoints on port 8443, which may indicate an attacker attempting to export SD-WAN configuration data following an exploitation event.
Detects the execution of a JSE file by a script host (wscript.exe or cscript.exe) followed by the immediate deletion of that same file within a 5-minute window. This behavior is indicative of a 'fileless' or 'dropper' style execution pattern where a script is executed to perform malicious activity and then self-deleted to remove artifacts.
Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.
Detects bulk file downloads of executable or script content from web proxies using automated or headless client agents (e.g., curl, wget) where no browser-like Referer is present. The rule aggregates these downloads within a 10-minute window and correlates them with endpoint Sysmon file creation events in non-standard directories, indicating potential tool staging or malware delivery.
Page 684 of 1168