Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to specific registry keys related to Internet Explorer and Windows Internet settings, specifically those controlling HTTPS-to-HTTP redirects and app container isolation for binary controls. Attackers may manipulate these settings to bypass security restrictions or facilitate browser-based attacks.
This rule detects file creation, modification, or module loading events involving specific DLL files ('msvcr90.dll' or '7z.dll') from a suspicious directory path ('Traiolx Custom Utils'). This behavior is commonly associated with DLL side-loading, where an adversary places malicious or renamed legitimate DLLs into a specific directory to hijack execution flow.
This rule detects endpoint DNS queries or network connections to the suspected phishing domain 'gasparinutrition.com' initiated by common web browsers or email clients. This provides visibility into potential user interaction with malicious sites that would otherwise be missed by email security gateways.
This rule detects potential credential harvesting or malware delivery by identifying an email client (e.g., Outlook) launching a PDF reader, which subsequently executes a web browser. This sequence is a common indicator of a user interacting with a malicious link or 'Sign' button inside a PDF attachment opened directly from an email.
This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.
This rule detects potential data exfiltration through the Bing Image Search 'search-by-image' feature. It identifies web traffic to Bing that contains an 'imgurl' parameter, decodes the URL, and filters out legitimate Microsoft-related domains. It then flags suspicious, potentially encoded file paths or data structures that might indicate the use of this public service to exfiltrate or host staging data.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with command line arguments containing suspicious keywords such as 'AppData\Roaming', '.bat', 'xupdate.bat', or 'Traiolx Custom Utils'. This behavior is indicative of potentially malicious installation or post-exploitation activities.
Detects the execution of rundll32.exe when initiated by msiexec.exe or cmd.exe, particularly when the rundll32.exe process path or command line involves the AppData\Roaming directory or references specific custom utilities, which is a common pattern for fileless or staged malware execution.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Page 700 of 1168