Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe).
Detects outbound network connections over standard SSH ports (22, 2222) initiated by process names typically associated with web requests or package management (curl, git, php), potentially indicating unauthorized remote access, lateral movement, or data exfiltration from a compromised host to an external, non-private network address.
This rule detects HTTP POST requests to a MyBB forum administrative panel targeting the 'user-users' module, specifically attempting to assign a user to the 'Administrator' group (group ID 4). This pattern is indicative of an exploitation attempt or unauthorized administrative account manipulation.
Detects instances where the Ghidra software suite (via analyzeHeadless or ghidraRun) or its associated Java runtime initiates unexpected child processes, such as common system utilities (e.g., cmd.exe, powershell.exe, calc.exe) or executes scripts from untrusted locations like Temp, Downloads, or network shares. This behavior is indicative of potential exploitation attempts, such as arbitrary code execution triggered by a malicious project or script import.
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
Detects the execution of wmic.exe with commands querying Windows Management Instrumentation (WMI) classes (AntiVirusProduct, SecurityCenter2, Win32_Product) often used by the Grandoreiro banking trojan to identify installed security software and sandbox environments. The rule specifically monitors for suspicious parent-child relationships, such as wscript.exe, cscript.exe, or mshta.exe spawning wmic.exe, especially when the originating script or binary is unsigned or originating from non-standard paths like AppData.
Detects potential exploitation of FFmpeg via memory corruption vulnerabilities in RASC or DLTA codecs. The rule monitors for two indicators: FFmpeg spawning unexpected child processes (e.g., cmd.exe, PowerShell, calc.exe) after media processing, or FFmpeg being invoked with RASC/DLTA codec flags while processing media files located in common user-writable directories (Temp, Downloads, AppData).
This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.
This rule detects potential exploitation of the Ghidra vulnerability CVE-2026-45115, which allows arbitrary code execution during the loading of malicious project files or scripts. It monitors for suspicious child processes (e.g., cmd.exe, powershell.exe, bash) spawned by core Ghidra executables (ghidraRun, analyzeHeadless), which is characteristic of successful exploitation.
Detects instances where ImageMagick (magick.exe or convert.exe) spawns Ghostscript (gswin64c.exe, gswin64.exe, or gs.exe) from a directory other than the standard Ghostscript installation path. This behavior is indicative of a search order hijack where an attacker places a malicious binary in a location searched before the legitimate Ghostscript installation.
Page 686 of 1168