Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,585 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.
Detects the creation of multiple sequential screenshot files (JPG or BMP) within the C:\Users\Public\Videos directory. This activity is consistent with the SIGHTGRAB tool utilized by UNC1549 for visual intelligence collection.
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects an unauthenticated WebSocket or Socket.IO handshake attempt targeting the Peyara Remote Mouse service on TCP port 1313. This behavior is associated with the exploitation of known remote code execution vulnerabilities in the service.
This rule detects scenarios where the Microsoft HTML Help executable (hh.exe) is used to open a .chm (Compiled HTML) file, which then triggers the execution of wscript.exe. This behavior is a common technique used by attackers to execute malicious scripts hidden within CHM files, bypassing security controls by leveraging a legitimate system binary to initiate script execution.
Detects Node.js processes being executed with specific require flags or environment variables, while having parent processes or command-line arguments indicative of Flowise integration. This behavior is often associated with the execution of custom MCP (Model Context Protocol) tools or extensions within a Flowise workflow, which could potentially be abused for unauthorized operations or persistence.
Detects instances where a user within the MyBB Admin Control Panel (ACP) attempts to create a new user account and assign it to the administrator usergroup (gid=4). This activity is indicative of a privilege escalation attempt by an authenticated user with limited administrative access or an attacker who has compromised such an account.
This rule detects two distinct malicious activities related to Gitea installations: 1) Container escape attempts involving 'act-runner' processes configured with dangerous flags like --pid=host, --cap-add=ALL, or usage of nsenter, and 2) Potential administrative impersonation attempts against a Gitea instance via injection of the X-WEBAUTH-USER: admin HTTP header.
Detects phishing emails sent from personal Gmail accounts that use URL shorteners, include urgency-based legal lures in the subject line, and pass SPF/DKIM/DMARC authentication checks. The rule looks for indicators of spearphishing attempts leveraging social engineering and common evasion techniques like BCC delivery to bypass standard security filters.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Page 715 of 1168