Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,588 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
Detects network communication with known malicious domains associated with fraudulent or malicious 'Adblock for YouTube' browser extensions, as well as suspicious process command lines related to main world script injection performed by these extensions.
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
Detects the creation or modification of .vscode/tasks.json files that contain configurations designed to execute tasks automatically upon opening a folder in VS Code, specifically utilizing 'runOn': 'folderOpen' combined with visibility-hiding attributes such as 'reveal': 'never' and 'echo': false. This pattern is commonly associated with supply chain attacks where malicious payloads are hidden within project configuration files.
Detects a suspicious sequence of events where a non-root user executes the unshare utility to create a new user and network namespace, followed immediately by the execution of the tc (Traffic Control) utility with parameters (ingress, filter, pedit) indicative of network traffic manipulation or potential exploit exploitation within the created namespace.
Detects the creation or modification of a Windows service named 'MixedSvc' or containing 'Mixed Reality' in the command line where the binPath points to a non-System32 directory or the Windows Media Player folder, which is indicative of potential service hijacking or persistence techniques.
Detects the execution of known exploit-related binaries or command lines, including references to specific exploit source files (e.g., 'pedit_cow_demo', 'packet_edit_meme'), CVE identifiers, or specific traffic control (tc) configurations potentially used in exploitation activities.
This rule detects a suspicious sequence of events where a 'tc' (traffic control) command using 'pedit' is followed by a 'drop_caches' operation within a 5-minute window. This pattern is potentially associated with an evidence-wiping technique used to clear system caches after potentially malicious network manipulation or data staging activities, possibly linked to CVE-2026-46331.
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
This rule detects the execution of common scripting interpreters (powershell.exe, wscript.exe, cscript.exe, mshta.exe) where the command line arguments contain domains associated with the Dropbox API. This behavior is indicative of potential data exfiltration or the downloading of malicious payloads via a legitimate cloud storage service, a common technique for bypassing network filters and security controls.
Page 737 of 1168