Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects activities related to the compilation and execution of the DirtyClone PoC exploit (CVE-2026-43503) on Linux systems, including compilation from source, direct execution of the binary, and permission modifications on binaries within world-writable directories.
Detects coordinated security defense evasion activities by the Lambsys cryptominer campaign. The rule triggers when a shell process (bash, sh, or dash) is used to stop or disable security services (auditd, ClamAV, osquery, Falco, CrowdStrike Falcon), forcibly terminate their processes using pkill or kill -9, and delete or shred critical system security and audit logs (auth.log, syslog, audit).
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects Tycoon 2FA AitM using unique, high-entropy URL paths with low request counts
Correlates the execution of commands or Graph calls attempting to list Global Administrators or highly privileged roles within the tenant, specifically looking for 'List directory roles' actions combined with Azure AD sign-in events from non-corporate IP addresses.
Detects rapid, automated enumeration of Azure AD users, groups, and directory roles via the Microsoft Graph API immediately post-compromise. This rule identifies a high volume of queries (more than 50 within a 5-minute window) originating from a single account and IP address, targeting either 'Microsoft Graph' as the application or 'SearchQueryPerformed' as the action type.
Detects the execution of psql.exe with arguments pointing to a VeeamBackup database, or suspicious database queries containing 'credentials' or 'SELECT' statements. The rule specifically alerts when this behavior is initiated by PowerShell or WMI processes, which are common indicators of automated post-exploitation activities intended to extract sensitive information from the backup infrastructure.
This rule detects sensitive modifications to payroll-related information in Workday, such as bank account details, direct deposit settings, or payment method changes. It flags instances where such modifications occur from multiple IP addresses for the same user account, which may indicate account compromise and unauthorized attempts to divert funds.
Detects DNS queries for known StegoAd command-and-control infrastructure domains, which are used as proxy relays and exfiltration endpoints.
Page 769 of 1168