Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
Detects non-browser processes that load 'clr.dll' (indicating in-process .NET/CLR usage) and are sending large volumes of outbound data to Google API domains (sheets.googleapis.com, oauth2.googleapis.com, googleapis.com). This behavior is consistent with the SHEETCREEP threat actor's use of Google Sheets API for command and control (C2) and data exfiltration.
This rule detects the use of 'sshpass' in conjunction with specific command-line arguments that indicate automated SSH logins. It specifically looks for the presence of '/sshpass/' and '/StrictHostKeyChecking=no/' in the command line, combined with common administrative account names like 'psoft', 'oracle', or 'linuxadm'. This activity is often associated with lateral movement techniques, as observed in attacks like those by ShinyHunters targeting Oracle/PeopleSoft environments.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
This rule detects a potential AWS S3 bucket name hijacking scenario. It looks for instances where an S3 bucket is deleted and then a new bucket with the exact same name is created within a short time frame (up to 1 hour) by a *different* AWS account. This pattern can be used to hijack S3 replication rule destinations, enabling silent data exfiltration to an attacker-controlled account. The rule also attempts to identify if the original bucket had replication configured.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
Page 767 of 1168