Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.
This rule detects activities related to clearing or deleting Windows Event Logs, including usage of 'wevtutil.exe' to clear specific logs, 'cmd.exe' or PowerShell ('Remove-Item') to manually delete '.evtx' files, and the erasure of the USN journal via 'fsutil.exe'. It also detects the actual occurrence of Event IDs 1102 (Security log cleared) and 104 (System log cleared). The rule correlates these events with preceding service installations within the last 24 hours to distinguish between potential attacker anti-forensics activity and routine administrative maintenance.
Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
Detects post-exploitation system discovery and reconnaissance commands performed by PeopleSoft service accounts (psoft, oracle, linuxadm) on Linux hosts. This activity aligns with observed techniques from the ShinyHunters CVE-2026-35273 campaign, where compromised service accounts were used to map the local environment.
Detects potential exploitation of CVE-2026-20127 on SD-WAN controllers, specifically unauthorized SSH authentication to the vmanage-admin account followed by suspicious NETCONF activity, usage of unauthorized tenant list CSV files, or execution of suspicious tenant-upload scripts.
This rule monitors DNS query events for domains known to be associated with phishing campaigns, specifically those spoofing Microsoft or other common service brands. These domains are frequently used in credential harvesting attacks to lure users to malicious landing pages.
Page 759 of 1168