Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of the RoadTx tool to perform a Resource Owner Password Credential (ROPC) grant against Microsoft Graph while bypassing MFA. This behavior leverages CVE-2025-0309 by abusing hidden Conditional Access exclusions for specific client IDs, resulting in an authentication token issued without an MFA claim.
Detects non-Steam processes accessing Steam configuration files (e.g., config.vdf, loginusers.vdf, ssfn files) and reading Steam-related registry keys. This behavior is indicative of infostealer malware attempting to hijack Steam sessions or exfiltrate account configuration data.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects the Atomic macOS Stealer (AMOS) malware establishing persistence by creating a LaunchAgent plist file ('com.hlpr.agent.plist') and subsequently loading it using the 'launchctl' utility.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects the creation of plist files within macOS /Library/LaunchAgents/ or /Library/LaunchDaemons/ directories by the osascript utility. This behavior is indicative of Meow RAT establishing persistence by masquerading as a legitimate system service.
Detects unauthorized usage of the 'osascript' command to interact with the 'security' binary on macOS, specifically targeting keychain operations such as dumping, finding generic passwords, or unlocking the login keychain. This behavior is indicative of Meow RAT attempting to exfiltrate credentials from the macOS Keychain or browser-stored secrets.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
Page 775 of 1168