Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
Detects inbound network connections from a specific list of known suspicious or untrusted external IP addresses targeting sensitive management ports (SSH, NETCONF, and vManage-HTTPS-API). The rule identifies if the connection is made by a privileged account (e.g., admin, root) to highlight potential unauthorized management access attempts.
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
This rule detects instances where the Ghidra reverse engineering suite (or associated Java processes running Ghidra components) initiates suspicious child processes. This behavior is considered anomalous as standard reverse engineering activities in Ghidra should not require the execution of system administrative tools, interpreters, or networking utilities, which may indicate an attacker using a compromised development environment to launch secondary payloads or tools.
This rule detects potentially malicious activity associated with the RustDesk remote access tool. It monitors for two conditions: 1) RustDesk spawning suspicious child processes (e.g., shells, scripting engines, or network tools) that indicate post-exploitation behavior. 2) The RustDesk binary being executed from an unusual parent process, which may indicate session hijacking or unauthorized installation.
Detects unauthorized SSH-based lateral movement originating from a compromised Cisco SD-WAN vManage controller to vSmart or vBond components. The rule monitors for SSH sessions initiated by administrative users (admin, vmanage-admin) and subsequent unauthorized file permission modifications (chmod/chown) on sensitive system files and directories, such as SSH authorized_keys and system configuration files, which are indicative of post-exploitation activities.
Detects execution of rclone or the creation of an rclone configuration file (rclone.conf) occurring on a host within 24 hours of QEMU virtualization activity. This combination may indicate an adversary using virtualization software for staging or research, followed by data exfiltration via rclone to a remote cloud destination.
Detects post-exploitation activities on Cisco SD-WAN Manager (vManage) systems. The rule identifies suspicious command execution patterns including shell spawning via SSH, use of administrative/backdoor accounts (troot), privilege escalation attempts using su, enumeration commands commonly used by attackers, unauthorized modification of sensitive system files (/etc/passwd, /etc/shadow), the use of specific malicious tenant-upload CLI operations, and outbound reverse-shell connections.
Page 773 of 1168