Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects execution of SharpHound (BloodHound) for Active Directory enumeration and subsequent exfiltration of collected datasets, specifically tracking activity attributed to the MexicanMafia (Operation Escaneo).
This rule detects the creation or modification of specific files associated with known malicious activity or remote access tools, specifically looking for shortcut files (LNK) named 'ApplianceConfig', 'ServerConfig', 'CredentialsConfig', or AnyDesk configuration files ('anydesk_svc.conf', 'anydesk_usr.conf'). These file patterns are often used by threat actors for persistence or to facilitate remote control.
This rule detects scenarios where an Oracle database process (or associated service processes) spawns potentially malicious OS-level child processes, such as shells, network utilities, or script execution. This behavior is highly indicative of abuse of Oracle features like DBMS_SCHEDULER or UTL_FILE to execute arbitrary commands, perform network reconnaissance, or stage exploit payloads.
Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.
This rule detects the execution of the BloodHound or SharpHound Active Directory enumeration tools by monitoring for specific process names, command-line arguments associated with the tool's common flags (e.g., --CollectionMethod, --ZipFileName), and file paths containing these tool names.
Detects exploitation attempts of the Zerologon vulnerability (CVE-2020-1472) by monitoring for specific process executions related to Impacket tools (secretsdump, zerologon_tester), suspicious domain controller machine account password resets via Windows Event ID 4742, and high-frequency Netlogon authentication failures (Event ID 4776) typical of the zero-length client challenge brute force attack.
This rule monitors process execution events for the presence of the Chisel network tunneling tool. It identifies Chisel by its executable names (e.g., chisel.exe, chisel_linux) and command-line arguments typical of a Chisel client or server configuration, including SOCKS proxy setups and known indicator ports.
This rule detects lateral movement activity associated with the Impacket toolkit. It monitors for the execution of common Impacket scripts (e.g., psexec.py, smbexec.py, wmiexec.py) or binaries (psexec.exe/PsExec64.exe) spawning from suspicious parent processes or interacting with sensitive Windows shares (ADMIN$, IPC$). Additionally, it flags Python processes performing SMB connections to multiple internal hosts, as well as cmd.exe/powershell.exe instances spawned from services.exe that reference Impacket tool names in their command lines.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.
Page 776 of 1168