Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of consent.exe from a temporary directory path, which is often used in UAC bypass attacks to masquerade as the legitimate Windows UAC prompt process.
Detects non-interactive Microsoft Graph OAuth2 token requests originating from unmanaged, deviceless sessions that falsely claim MFA satisfaction. The detection focuses on specific user agents known to be associated with automated token replay attacks and looks for multiple unique token identifiers per user session, which is indicative of credential or token theft rather than standard service account or application activity.
This rule detects the execution of common network share enumeration tools or scripts, specifically looking for the execution of netscan.exe (or similar) or PowerShell commands utilizing common share finding utilities like Invoke-ShareFinder, CheckShareAccess, or commands exporting share information to files.
Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process using the built-in Windows comsvcs.dll via rundll32.exe or tasklist commands, a common technique used for credential harvesting.
Detects the installation of specific browser extensions in Microsoft Edge followed by network connection activity to external IP addresses. This behavior is indicative of potential malicious browser extensions, such as those used for browser session hijacking, credential theft, or command and control (C2).
Detects automated payroll fraud attempts by monitoring for scripting engines initiating HTTP connections to known payroll platforms (e.g., Workday, ADP) or spawning child processes with payroll-related command-line arguments. This behavior is indicative of post-AiTM session abuse, where attackers manipulate financial accounts or automate unauthorized payroll changes via malicious scripts.
Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.
This rule monitors for suspicious activities related to System Informer (formerly Process Hacker) and its associated service (phsvc.exe). It detects unauthorized or unusual execution patterns, such as unsigned client binaries, shell spawning, or the use of specific proof-of-concept (PoC) command-line arguments that indicate attempts to abuse the service's privileged capabilities for process management or evasion.
Detects the installation of RustDesk as a persistent Windows service. RustDesk is a remote access tool that has been observed in intrusion chains, including those involving Akira ransomware, to provide hands-on-keyboard access to threat actors.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Page 770 of 1168