Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network activity and command line execution associated with known malicious browser extensions, specifically targeting AdBlock for Youtube-related extensions and associated command-and-control infrastructure.
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
This rule detects suspicious process execution patterns that are characteristic of fileless malware execution or malicious script handling. It specifically targets PowerShell commands using ReadAllText to read script content from stdin/env:0, the use of Sysnative paths for architectural bypasses, and the execution of setup.cmd files from 7Zip extraction directories.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.
Detects persistence mechanisms used by the Turla STOCKSTAY malware, specifically identifying the use of Registry Run keys (masquerading as 'MicrosoftUpdateOneDrive' or referencing the %LOCALAPPDATA%\Programs\SMN\ directory) and modifications to the AppInit_DLLs registry key.
Detects unauthorized processes reading AI assistant configuration files (e.g., Claude, Cursor, Gemini, VS Code) followed by an outbound network connection from a common scripting or runtime environment (node, python, bun) within 60 seconds, potentially indicating credential or configuration exfiltration.
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Page 760 of 1168