Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,591 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous child process creation from PHP-FPM or PHP web worker processes. This is indicative of exploitation activity, specifically targeting vulnerabilities in PHP environments where deserialization or memory access (e.g., ASLR bypass via /proc/self/maps) leads to unauthorized code execution and subsequent command-line tool usage.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
This rule detects persistence mechanisms associated with the SHARDLOADER threat activity, specifically monitoring for the creation of suspicious Registry 'Run' keys using the 'MediumNetMonIt' value or via scheduled task creation referencing known staging paths under 'C:\ProgramData\IDM\logs\'.
Detects unauthorized processes (Python, Node.js) accessing sensitive files such as browser login data, cookie stores, wallet files, and SSH/AWS keys, which are common indicators of credential theft and data exfiltration.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects execution of the SharpADWS utility or anomalous network connections to the Active Directory Web Services port (9389) that are not initiated by legitimate processes such as lsass.exe, svchost.exe, or the legitimate Microsoft.ActiveDirectory.WebServices.exe binary.
This rule detects potential persistence mechanisms by monitoring for the creation of specific, suspicious scheduled tasks or the modification of registry values. The patterns flagged include known indicators of malicious activity such as specific directory paths (e.g., \ProgramData\IDM\logs\ or \Microsoft\VaultCache\) and known malicious file names associated with unauthorized background execution.
This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Page 757 of 1168