Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects URL credential confusion attempts where an attacker injects an @ symbol into URL-based query parameters. By including an '@' character, the attacker forces a mismatch between how a hostname validator parses the URL (seeing a legitimate hostname like github.com as the userinfo component) and how the backend fetcher resolves the URL (ignoring the userinfo and resolving the host following the @ symbol), potentially enabling Server-Side Request Forgery (SSRF) or local file read bypasses.
Detects instances where DllHost.exe (COM Surrogate) creates executable or script files in high-risk, user-writable directories. This activity is indicative of potential exploitation of the Windows Subsystem for Linux (WSL2) filesystem proxy, where a Linux process running within WSL2 writes files to the Windows host filesystem (/mnt/c/), resulting in the file creation event being attributed to the DllHost.exe COM surrogate on the Windows side.
Detects the execution of Perl-based SOCKS proxy tunneling activity on Linux systems, as observed in Velvet Ant operations. The rule identifies Perl processes that contain socket/fork/daemonization indicators when spawned by web server processes like Nginx, Apache, or common shells used in CGI contexts, suggesting the exploitation of a web application to establish an internal network pivot.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
This rule detects anomalous spikes in inbound network connections to common edge device management ports (80, 443, 8080, 8443) by baselining the number of unique source IP addresses per destination over a 30-day window. It triggers an alert when the hourly count of unique source IPs deviates significantly (greater than 3 standard deviations) from the historical mean, which may indicate active network scanning or brute-force attempts.
This rule detects outbound network traffic from internal IP addresses to known Tor network entry or exit relay ports (9001, 9030, 9050, 9051). It specifically prioritizes alerts where the source host is identified as network infrastructure (routers, gateways, firewalls) or IoT devices, flagging potential unauthorized use of Tor for obfuscated communication or data exfiltration from within the network perimeter.
Detects instances where a process, other than standard browsers or common system applications, loads 'WINHTTP.dll' and subsequently initiates outbound HTTPS connections. This behavior is often indicative of custom malware or specialized tooling, such as the NUKESPED/Kimsuky framework, using direct API calls for command and control (C2) communication to bypass standard application-based network filtering.
Detects user-space processes masquerading as critical Linux kernel threads (kworker, kthreadd, ksoftirqd). The rule identifies potential impersonation by monitoring for suspicious parent processes (e.g., shells, interpreters), anomalous parent PIDs (not 1 or 2), or unexpected network socket activity generated by these kernel-named processes.
Detects the creation of files by WScript.exe or CScript.exe in temporary or program directories followed by the subsequent execution of those files by the same scripting host within a 120-second window. The rule specifically looks for evidence of script-based decoding or processing (e.g., via certutil or hidden windows), which is often associated with the multi-stage execution of payloads.
Detects long-running WScript or CScript processes executing script files (ending in .js or .jse) that perform environment enumeration via WMI queries (e.g., Win32_ComputerSystem, Win32_BIOS, Win32_VideoController). This behavior is often indicative of automated sandbox evasion and reconnaissance performed by malicious scripts or droppers.
Page 735 of 1168