Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to exploit Velocity Template Language (VTL) injection vulnerabilities in the Floci API Gateway, specifically targeting MOCK integration configurations on port 4566. The rule monitors for the injection of malicious Java objects via response templates, deployment of these templates, and the execution of the RCE payload via a specific API endpoint path, including potential IAM enforcement bypass attempts.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects the execution of PowerShell commands that exhibit characteristics of reverse shells, such as the use of Nishang or Invoke-PowerShellTcp scripts, or the combination of web-download commands with expression evaluation. The rule also calculates a risk score based on the presence of common AMSI bypass flags (e.g., hidden windows, execution policy overrides) and specific reverse shell indicators.
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects AI-powered development tools like Claude Code (running via node) spawning shell interpreters, executing common setup/configuration scripts, or invoking network utilities during project initialization. This activity is indicative of indirect prompt injection attacks where an adversary lures an AI agent into executing malicious code from a repository.
Detects command and control (C2) activity attributed to threat actor UAC-0226 by monitoring for direct network connections to known hardcoded C2 IP addresses from suspicious process paths or PowerShell, and by identifying beaconing patterns (regular HTTPS intervals) originating from non-browser processes in sensitive locations like ProgramData or AppData/Local/Temp.
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Page 687 of 1168