Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential screen capture activity by the Remcos RAT by monitoring for image file creation in the AppData\Roaming\Screenshots directory with specific naming patterns ('time_' or 'wnd_'). The rule scopes this to processes executing from suspicious paths such as AppData or ProgramData, while filtering known legitimate screen capture software.
Detects information stealer malware, such as LokiBot or StealC, attempting to enumerate installed security software, firewall configurations, and system services. The rule monitors for WMI queries to 'SecurityCenter2' or registry enumeration of uninstallation/service keys originating from processes executing within user-writable, high-risk directories such as Temp, Downloads, or ProgramData, while filtering out known legitimate system processes.
Detects the execution of a bash script dropper ('isp.sh') associated with Langflow RCE exploitation (CVE-2026-33017). The rule triggers when command-line arguments indicate an attempt to download and execute the 'lambsys.elf' Go-based cryptominer from a known malicious IP address (83.142.209.214).
Detects signs of a session hijacking attack using the OAuth device code grant flow, specifically identifying the initial device code authorization followed by suspicious post-authentication activity like mass data access via Microsoft Graph API or the creation of mailbox forwarding rules.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.
Detects a multi-stage attack pattern involving a 'spam bomb' (high volume of inbound emails) followed by an external Microsoft Teams message and the subsequent execution of Windows Quick Assist (quickassist.exe or msra.exe) on the target endpoint. This behavior is highly indicative of a tech support scam or social engineering attack where an adversary floods a user's inbox to create urgency, contacts them via Teams, and convinces them to initiate a remote support session.
Detects anomalous child process execution (PowerShell, mshta, wscript, cscript, or cmd) spawned by common web browsers, which is consistent with the execution chain of CastleLoader malware delivered via EvilTokens PhaaS and ClickFix CAPTCHA lures. These lures typically trick users into copying and pasting commands into the Run dialog or directly into the shell.
Detects the WinSCP utility initiating an outbound network connection to port 22 (SFTP/SCP). This behavior is often associated with post-compromise activity where adversaries use legitimate file transfer tools to exfiltrate data to attacker-controlled infrastructure.
Page 742 of 1168