Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
Detects the execution of Ghostscript (gswin64c.exe) by ImageMagick (magick.exe or convert.exe), where the binary location does not appear to be a standard installation path. This behavior is a common indicator of exploitation attempts against ImageMagick vulnerabilities, such as ImageTragick or subsequent Ghostscript-based file processing exploits.
This rule monitors DNS query logs for requests to specific domains associated with malicious activity. It aggregates these requests by endpoint to identify potential command and control (C2) communication or beaconing behavior.
This rule detects processes that are not common browsers (chrome, msedge, firefox, etc.) initiating a network connection over the STUN protocol (UDP port 3478) while simultaneously running with a command-line argument containing '--kiosk'. This pattern often indicates potential command-and-control (C2) communication or unauthorized network traversal disguised as normal traffic from kiosk-mode applications.
Detects indicators of exploitation attempts targeting the c-ares asynchronous DNS library, specifically focusing on Use-After-Free (UAF) vulnerabilities. The rule monitors for the presence of known proof-of-concept (PoC) file artifacts, execution of processes using specific command-line flags associated with c-ares exploit research, suspicious shell/calculator spawning from common network-enabled applications (curl, node, python), and anomalous high-frequency DNS-over-TCP traffic patterns.
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects network requests from the Firefox browser process containing URI patterns and parameters often associated with data exfiltration or browser-based reconnaissance, including suspicious leakage parameters and local proxy/loopback communication attempts on non-standard ports.
Detects potential exploitation attempts targeting the Flowise 3.1.2 Custom MCP (Model Context Protocol) stdio interface. The detection monitors for the bypass of environment variable validation where lowercase 'node_options' is used to circumvent security controls blocking 'NODE_OPTIONS', potentially allowing unauthorized code execution via '--require'. It also alerts on the presence of associated PoC artifacts and anomalous outbound network activity from Flowise processes.
Page 777 of 1168