Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,586 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects remote code execution (RCE) attempts targeting PHP 8.5.7 StreamBucket SOAP vulnerability. The rule monitors for suspicious child process creation originating from web server processes (php-fpm, php, apache, httpd) including shells, scripting engines (python, perl, ruby), or network utilities (nc, curl, wget).
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
Detects Log4Shell JNDI exploitation attempts by scanning incoming network request data for JNDI patterns and simultaneously monitors for suspicious shell child processes (cmd, powershell, bash, sh) spawned by java.exe, indicating post-exploitation activity.
This rule detects network connections and email URLs that match known typosquatted patterns of Microsoft domains. It aims to identify potential phishing attempts or traffic directed to infrastructure used by the 'Bulletproof Redirect Engine' masquerading as legitimate Microsoft services. The logic filters out legitimate Microsoft-related URLs to minimize false positives.
Detects anomalous outbound network connections from node.exe processes initiated by developer tools like VS Code, npm, or installation binaries. The rule specifically monitors for patterns indicative of Command and Control (C2) communication, including high-frequency Socket.io polling, WebSocket upgrades, and long-duration connections to external, non-private IP addresses.
This rule detects potentially malicious activity associated with Java applications or the Lunar Client, specifically targeting the creation of shortcut files (.lnk, .command, .desktop) by Java processes, and the unexpected spawning of shells or interpreters by 'javaw.exe' or Lunar Client processes. These patterns are consistent with modpack-based Remote Code Execution (RCE) attempts or abuse of Electron IPC mechanisms.
Detects the installation and operation of the RustDesk remote access tool as a persistent Windows service. This behavior has been identified in the Akira ransomware intrusion chain where adversaries utilize remote access tools for post-compromise persistence and control. The rules monitor for service creation via command-line utilities (sc.exe, PowerShell), registry modifications related to service configurations, and Windows Service Control Manager events (Event ID 7045) that register RustDesk as a persistent system service.
Detects the use of net.exe or net1.exe to create domain accounts or grant them administrative privileges (Domain Admins or Enterprise Admins) in Active Directory. This behavior is indicative of pre-ransomware persistence techniques employed by the Akira threat group, where attackers create specific service accounts and elevate their privileges before ransomware deployment.
This rule detects potential Adversary-in-the-Middle (AiTM) session hijacking by monitoring for successful multi-factor authentication (MFA) events on unmanaged or non-compliant devices, followed within 30 minutes by an API request from a geographically distant location. It includes logic to flag suspicious User-Agent strings often associated with automated AiTM tools.
Page 713 of 1168