Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.
Detects instances where language-related processes (amazonq-language-server, node) or common tools (bash, sh, curl, aws) execute commands containing AWS access credentials or perform potential data exfiltration via curl POST requests.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.
Detects the creation of potentially malicious executable or script files (.exe, .lnk, .vbs, .ps1, .hta) or autorun.inf files on removable drives (D-Z) initiated by common script interpreters or suspicious processes. This activity is then correlated with prior detections of Gamaredon (ACTINIUM/Primitive Bear) implant activity, such as Ptero-family malware, specific obfuscated PowerShell patterns, or HTML smuggling delivery via mail/Office clients on the same host within a 24-hour window.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects successful password spraying attempts against Entra ID using the Resource Owner Password Credentials (ROPC) flow where multi-factor authentication (MFA) is bypassed. This rule specifically looks for multiple failed ROPC sign-in attempts from an IP address followed by a successful ROPC sign-in from the same IP address, where the authentication method reference (amr) claim does not include 'mfa'. This pattern is consistent with potential abuse of Conditional Access policy hidden exclusions, as described in CVE-2025-0309.
Detects DLL sideloading behavior associated with Operation DragonReturn, where the malicious executable COU_ITR-1_to_4_AY2026-27.exe launches or drops malicious components (nvdaHelperRemote.dll or Mixed Reality.exe) within the Windows Media Player directory.
Detects execution of processes associated with Millenium RAT that contain specific strings indicating sandbox evasion techniques, including environment checks and stalling loops (Thread.Sleep/MemoryInfoDetector) used to bypass automated analysis.
Detects DcRAT malware creating or modifying a specific file (c:\debug.txt) used for staging keylogging or screenshot data. This rule monitors for file creation followed by modification events, a pattern associated with the adversary's method of log consolidation and potential obfuscation.
Page 696 of 1168