Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects patterns indicative of automated brute-force attacks against authentication interfaces by counting consecutive remote logon failures for single user accounts. This behavior was observed in the FortiBleed campaign targeting Fortinet devices.
Detects a multi-stage attack chain beginning with the execution of suspicious processes (mstsc.exe, mshta.exe) from email clients or download directories, followed by WinRAR or unrar.exe writing files containing path traversal sequences, and concluding with the execution of a child process from a suspicious directory. This behavior aligns with exploitation attempts targeting vulnerabilities like CVE-2025-8088.
Detects the enumeration of installed security and monitoring software, such as Sysmon, Filebeat, and Microsoft Defender, using common system administration tools including sc.exe, tasklist.exe, wmic.exe, PowerShell, and reg.exe. This activity is often associated with reconnaissance performed prior to disabling security features on a compromised host.
Detects the execution of known Active Directory enumeration tools such as AdFind and BloodHound/SharpHound, or manual net group domain queries, executed on hosts that may lack standard EDR instrumentation. This pattern is commonly associated with adversary lateral movement and reconnaissance in ransomware affiliate operations.
Detects the use of WinRAR or rar.exe to create password-protected archives or archive files within temporary, user-writable, or public directories. This behavior is indicative of data staging by an adversary to prepare information for exfiltration.
Detects malicious activities associated with Akira ransomware affiliates, including Active Directory enumeration using AdFind, data staging via WinRAR, and exfiltration attempts utilizing tools like WinSCP, rclone, or MEGAcmd. The rule also monitors for the presence of campaign-specific malware binaries.
This rule detects potential web shell activity on ColdFusion or IIS servers by monitoring for the creation of known malicious file names typically associated with web shells and the execution of suspicious child processes (e.g., cmd.exe, whoami.exe, powershell.exe) by common web server worker processes (w3wp.exe, coldfusion.exe, jrun.exe). It also identifies suspicious command-line patterns referencing the web root directory.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.
Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.
Page 694 of 1168