Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.
Detects endpoint browser and email client processes initiating network connections to domains and IP addresses associated with HolaBrief and LoopedIn open-redirect infrastructure, commonly leveraged in invoice-themed phishing campaigns.
Detects network connection attempts or DNS queries to a set of specific domains ('holabrief.com', 'loopedin.io') that are known to be associated with suspicious activity or potential command and control infrastructure.
This rule detects file access events involving specific file names ('DscCoreR.mui', 'SyncRes.dat', 'GameInputInboxs32.mui', 'diagerr.xml', 'NtfsLog.etl', 'Ignored.Dat', 'VistaCompat.nls') that have been historically observed as indicators of the HUI Loader malware. HUI Loader is a custom DLL loader used by various threat actors to sideload malicious payloads.
Detects when the IIS worker process (w3wp.exe) spawns common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This behavior is often a strong indicator of webshell activity or exploitation of web applications such as Microsoft Exchange or SharePoint.
This rule monitors for the execution of common reconnaissance, enumeration, and scanning tools often used in post-exploitation scenarios. It detects the usage of scanners like fscan, network discovery utilities like net.exe, nltest, dsquery, and credential/directory enumeration tools like SharpHound. These tools are commonly used for domain discovery, network mapping, and collecting information for lateral movement or privilege escalation.
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Page 707 of 1168