Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
This rule monitors for the creation of the 'adprinterpipe' named pipe by the AnyDesk remote support application. This behavior can be indicative of remote session activity or misuse of the AnyDesk software, often used as a vector for remote command and control.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
Detects instances where the 'splunkd' process acts as a parent to common command-line interpreters (e.g., bash, powershell, python) or network utilities (e.g., curl, wget, netcat, nmap). This behavior is highly suspicious as the Splunk daemon should not typically invoke shells or network tools, and may indicate exploitation of the Splunk environment, lateral movement, or unauthorized task execution.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
This rule detects a remote interactive logon (Logon Type 10) via RDP, followed by a PowerShell process executing 'net.exe' with sensitive administrative arguments such as 'administrator', '/active:yes', or '/dom'. This pattern is highly indicative of an adversary attempting to elevate privileges or modify domain/local account properties after establishing initial access via Remote Desktop.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
Page 771 of 1168