Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects AI coding agents (such as Claude Code, Cursor, Copilot CLI, etc.) spawning shell interpreters (bash, cmd, powershell) to execute installation or configuration scripts from within git-cloned repository directories. This activity is indicative of indirect prompt injection attacks where an adversary manipulates the agent into autonomously running malicious setup code.
Detects modification or creation of registry run keys in HKLM or HKCU hives that point to suspicious paths (AppData, Temp, ProgramData, or specific SharkLoader directories) or filenames (SystemSettings.exe). This behavior is indicative of malware attempting to establish persistence.
This rule detects potential process injection attempts targeting the Windows Update Service (wusvc.exe). It monitors for suspicious API calls, including VirtualAlloc, VirtualProtect, WriteProcessMemory, and QueueUserAPC, or memory page protections set to PAGE_EXECUTE_READWRITE within the context of the wusvc.exe process. The detection requires multiple distinct indicators of injection to be present, reducing the likelihood of flagging benign administrative activities.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Detects various techniques used to extract the Active Directory NTDS.dit database on Windows. The rule monitors for the misuse of administrative tools including ntdsutil.exe (for IFM or instance activation), vssadmin.exe (to create volume shadow copies as a prerequisite), and esentutl.exe (for direct ESE database operations). The detection focuses on suspicious command-line patterns indicative of credential dumping attempts.
Detects Active Directory domain group enumeration activities associated with StrikeShark post-compromise tooling. The rule monitors for Event ID 4661 object access requests to domain groups with specific access masks, as well as the execution of reconnaissance commands via net.exe or the usage of SharpGPOAbuse.exe, which are known indicators of StrikeShark operations.
Detects instances where a process launch exhibits PPID spoofing (where the reported parent PID does not match the actual creator PID) followed by that spoofed process attempting to access high-privileged system processes such as lsass.exe, services.exe, or winlogon.exe within a two-minute window. This behavior is indicative of privilege escalation attempts.
Detects a burst of reconnaissance activity typical of the StrikeShark toolkit, where an adversary executes four or more distinct system enumeration commands (systeminfo, whoami, ipconfig, net view, hostname, nltest, arp) from the same host and parent process within a 120-second window. The rule excludes common system management process lineages to reduce noise.
Identifies anomalous session cookie replays where a user token logs in without interactive MFA from an entirely different geographic location within minutes. This rule specifically looks for non-interactive sessions (IsInteractive == false) where a single AccountUpn (user) has IP addresses from two or more distinct geographic locations within a 30-minute window.
Detects processes that install a low-level keyboard hook (WH_KEYBOARD_LL) and are simultaneously involved in suspicious activity, such as network connections to non-private IP addresses and file writes to typical temporary directories (e.g., C:\Windows\Temp, C:\Users\Public). This behavior is characteristic of keylogging activity and subsequent data exfiltration or staging.
Page 688 of 1168