Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Detects a suspicious multi-stage infection sequence associated with DcRAT, characterized by a process spawning a child with references to image files (.jpg/.jpeg), followed by the loading of an unsigned DLL from the same directory, and culminating in a TLS network connection within a narrow time window.
Detects multiple indicators of process injection into svchost.exe including suspicious process access rights, remote thread creation, unexpected loading of .NET CLR modules, and the subsequent spawning of suspicious child processes. The rule aggregates these signals to identify potential fileless execution or persistence mechanisms within a legitimate system process.
Detects exploitation attempts of the Zerologon (CVE-2020-1472) vulnerability using Impacket tools. The rule monitors for unauthorized machine account password resets via Netlogon, execution of common exploitation scripts like zerologon_tester.py or secretsdump.py, and suspicious NTLM anonymous authentication patterns often associated with the exploit.
Detects the execution of a self-deletion routine associated with the TinyRCT backdoor. The rule identifies the use of the Windows 'choice' command to introduce a deliberate delay before deleting the malicious executable 'PerfWatson2.exe' from the AppData Local directory.
Detects the execution of the TinyRCT backdoor, which attempts to masquerade as the legitimate PerfWatson2.exe binary. The detection focuses on the process running from the AppData/Local directory, a common location for user-level malicious payloads.
Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.
This rule detects potential exploitation of CVE-2025-8088 involving WinRAR or unrar processing malicious archives with path traversal characters (../ or ..\). It identifies the extraction of script files (HTA, VBS, PS1, BAT) into the Windows Startup folder, followed by the execution of these files via mshta.exe or wscript.exe within a 30-second window, characteristic of Gamaredon group persistence mechanisms.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Page 706 of 1168