Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,242 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous process execution by PeopleSoft application server processes (e.g., psappsrv, jsvc) immediately following an inbound network request. This behavior is indicative of exploitation of a Java deserialization gadget chain, such as those used by the threat actor UNC6240 to achieve Remote Code Execution (RCE) and spawn command interpreters.
Detects the WMI provider host (wmiprvse.exe) spawning common living-off-the-land binaries often associated with command execution or lateral movement.
Detects the creation of suspicious scheduled tasks using the Windows schtasks.exe utility. The rule flags tasks that are configured to run as SYSTEM, include PowerShell encoded commands, or target directories commonly used for persistence such as Temp, AppData, or Public.
Detects the creation of named pipes associated with default Cobalt Strike malleable profiles and common open-source C2 frameworks (e.g., Sliver, Havoc) via EDR pipe-creation telemetry. These pipes are frequently used for SMB beacon communication within compromised networks.
Detects the ClickFix behavioral pattern where Windows Explorer (typically triggered via the Run dialog) directly spawns PowerShell.exe. This activity is indicative of a user being socially engineered into copying and executing a malicious command from a fake CAPTCHA lure directly into the shell.
Detects a sequence of suspicious activities including local account creation, modification of account security policies, and enabling of administrative services or credential exposure settings within a short time window. This typically indicates post-exploitation behavior where an adversary is attempting to establish persistence or facilitate further lateral movement.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit, and PowerShell) to delete Volume Shadow Copies, backup catalogs, or disable system recovery features. This is a common tactic used by ransomware and destructive actors to prevent system recovery.
Identifies suspicious processes performing beacon-like network communications with rare external destinations. The rule detects consistent hourly activity intervals and high connection counts to endpoints rarely contacted by other devices in the organization, serving as a heuristic for automated C2 beaconing.
Detects instances where a process writes to known persistence locations, including Windows Registry Run keys, the Windows Startup folder, Linux shell profile configuration files (.bashrc/.bash_profile), and system-level task directories (cron and systemd units). This activity is often indicative of malicious persistence mechanisms, such as those used by compromised AI agents or backdoors to survive system reboots.
Detects the execution of PowerShell with encoded command arguments (e.g., -enc, -EncodedCommand) combined with common web-request cmdlets or download-cradle patterns (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is frequently used by adversaries to execute obfuscated remote payloads in memory.
Page 7 of 1168