Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of rundll32.exe when initiated by msiexec.exe or cmd.exe, particularly when the rundll32.exe process path or command line involves the AppData\Roaming directory or references specific custom utilities, which is a common pattern for fileless or staged malware execution.
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
This rule detects potential LegionLoader activity by monitoring for specific file staging in AppData/Roaming directories and suspicious registry queries related to security settings and Internet Explorer/Windows configuration values. The rule correlates process execution via msiexec.exe, rundll32.exe, or dllhost.exe with the creation of known staging artifacts and security-weakening registry modifications.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
Detects spearphishing emails targeting high-value executive recipients (CEO, CFO, etc.) that contain PDF attachments and use subject lines related to settlement or distribution agreements. The rule specifically looks for inbound traffic routed through Google Workspace (gappssmtp.com) infrastructure, indicating potential use of compromised legitimate domains to distribute malicious lures.
Detects the installation or presence of a specific malicious Chromium browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) associated with Perplexity AI-themed phishing or malicious activity. The rule monitors file system events, process command lines, and registry modifications related to the Chrome Extensions directory.
This rule detects suspicious activity associated with the BeepRAT malware loader chain. It monitors for the execution of TCC.exe (a common name for Tiny C Compiler used by some malwares for dynamic compilation) with specific command-line arguments like -nostdlib and -run, as well as the spawning of suspicious child processes (cmd.exe, powershell.exe, or conhost.exe) by TCC.exe or the presence of a temp.bin file in the command line, which is indicative of BeepRAT shellcode loading behavior.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.
This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.
Page 701 of 1168