Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of the native Windows wbadmin.exe utility to initiate a backup that targets sensitive system files, such as the Active Directory database (ntds.dit) or registry hives (SYSTEM, SECURITY). This behavior is characteristic of an attempt to stage sensitive credentials or system configuration data for offline analysis or exfiltration, often performed as part of a credential dumping effort.
Detects attempts to perform credential dumping from the LSASS process memory using the built-in Windows binary rundll32.exe to execute comsvcs.dll. The rule monitors for specific command-line arguments and common output file paths associated with manual dumping or automated tools like lsassy.
Detects the use of rundll32.exe to invoke the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is a common method for dumping LSASS memory to harvest credentials, often used by tools like lsassy and various post-exploitation frameworks. The rule monitors for the specific command line patterns used in this attack, including referencing comsvcs.dll and the 'full' dump argument, initiated by suspicious parent processes frequently seen in lateral movement scenarios.
This rule detects abnormal, high-frequency network connection patterns originating from common web browser processes (msedge.exe, chrome.exe, brave.exe). It identifies scenarios where a browser process makes repetitive connections to a very small set of non-standard external domains, excluding common legitimate browser-related traffic. This behavior is indicative of background polling or C2 activity, such as that observed in malicious browser extensions (e.g., StegoAd) following an activation period.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
Page 712 of 1168