Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential indicators of an SSH/PAM backdoor. This includes three behaviors: 1) SSH-related system processes writing to suspicious file paths (e.g., /tmp, /dev/shm, or hidden files in user directories), 2) PAM sessions immediately followed by suspicious file writes, and 3) successful SSH authentications for usernames previously reported as 'Invalid' by the system, suggesting a tampered PAM module allowing arbitrary authentication.
Detects unauthorized write, modification, or rename operations within Linux Pluggable Authentication Module (PAM) directories (/lib/security, /lib64/security, /usr/lib/security, /etc/pam.d). The rule identifies activity performed by processes that are not recognized package managers (e.g., apt, yum, dpkg), which is a common technique used by threat actors to inject malicious authentication modules or backdoors (e.g., pam_unix.so replacement) to hijack authentication processes.
This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.
Detects the first-time execution of the Windows Subsystem for Linux (WSL) executable (wsl.exe) on endpoints that have not shown any WSL activity in the previous 29 days. This rule is scoped to workstations and laptops and specifically filters out endpoints tagged with developer-related identifiers to reduce noise on machines where WSL is a legitimate tool.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.
Detects unauthorized network connection enumeration using netstat or direct socket connections originating from fltMC.exe, which is indicative of JFMBackdoor activity. The rule monitors for netstat execution by fltMC.exe, netstat spawned from executables within temporary directories, and suspicious outbound network connections originating directly from fltMC.exe.
Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).
Page 734 of 1168