Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.
Detects the use of the Windows registry utility 'reg.exe' to query sensitive registry keys (SYSTEM, SOFTWARE, RUN keys) when executed by suspicious parent processes commonly used for script execution or living-off-the-land techniques (wscript.exe, cscript.exe, fltMC.exe, mshta.exe). This pattern is often indicative of automated discovery or credential harvesting behaviors.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
Detects the creation of executable files with suspicious naming patterns within the C:\ProgramData directory. The rule filters for files with specific file extensions or high-entropy name patterns that do not match common Windows executable file types, potentially indicating staging of malicious payloads.
This rule identifies potential use of the Tor network by detecting network connections to common Tor relay ports (9001, 9030, 9050, 9051, 9150) that are external to internal subnets, or by identifying DNS requests for .onion domains.
Detects high-frequency POST requests originating from outside internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that contain suspicious payloads in the request body (such as shell commands, downloading utilities, or busybox) or target common CGI-BIN paths, indicating a potential attempt to exploit a public-facing web server.
This rule detects two potentially malicious activities: the execution of 'fltMC.exe' from a 'Temp' directory, which is a known masquerading technique for the legitimate Windows filter manager utility, and the creation of an executable file within the 'C:\ProgramData\Windows Multimedia\ROG\' directory, which is a common path used by threat actors to stage malicious binaries.
Detects unusual processes making multiple connections to Google Sheets or OAuth2 APIs within a short timeframe, excluding known browsers and Google applications. This could indicate unauthorized data access, exfiltration, or command and control activity.
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.
Page 736 of 1168