Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of PowerShell with suspicious flags, obfuscation, or download cradles often used by the SystemBC/Coroxy malware to facilitate second-stage payload delivery and C2 activity.
Detects anomalous child process execution spawned by the AnyDesk service, indicative of exploitation of the adprinterpipe named pipe. This vulnerability involves a low-privileged attacker supplying malicious IStream bytes to the service to trigger code execution in the SYSTEM context.
Detects the transfer of executable or script files to remote administrative shares (ADMIN$, C$, IPC$) between hosts, a behavior frequently observed in SystemBC staging operations and lateral movement activities associated with ransomware actors.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects instances where ImageMagick (magick.exe) or legacy conversion tools (convert.exe) spawn Ghostscript executables (gswin64c.exe, gswin32c.exe) from non-standard or user-writable directories (e.g., Temp, AppData, Public). This pattern is indicative of a delegate path hijacking attack, where an adversary attempts to execute arbitrary code by forcing a vulnerable application to load a malicious Ghostscript binary instead of the legitimate, installed version.
This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.
Detects local privilege escalation attempts targeting the SystemInformer PhSvc helper service. The technique involves abusing the trust check within the PhSvc service by using rundll32.exe to connect to the SiSvcApiPort ALPC port and invoke privileged helper APIs, such as PhSvcApiCreateProcessIgnoreIfeoDebugger, to spawn processes with elevated privileges.
Detects remote code execution (RCE) attempts targeting Flowise/floci API Gateway services through Velocity Template Language (VTL) server-side template injection. The rule monitors for malicious payload patterns involving Java class reflection (e.g., ProcessBuilder) and unauthorized access attempts through API Gateway endpoints, including potential IAM scope bypass signatures.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new user account with administrator privileges (group 4). This rule identifies when an account with limited management permissions exploits the ACP to assign a new user to the administrator group, effectively bypassing intended permission restrictions.
This rule detects processes attempting to access sensitive Linux system files (/proc/[pid]/environ or /proc/[pid]/cmdline) or the specific file 'linux-process-env.json'. Such actions are indicative of an adversary attempting to perform system discovery, dump process environment variables for secrets, or collect process metadata.
Page 756 of 1168