Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
Detects instances where the FFmpeg or FFplay multimedia frameworks spawn unexpected child processes. This behavior is indicative of successful exploitation of the RASC/DLTA codec heap overflow vulnerability, where a malicious media file triggers arbitrary code execution.
Detects the execution or presence of identified exploit harness binaries and scripts associated with CVE-2026-55200, an RCE vulnerability in libssh2. The rule monitors process launches for specific filenames and command-line arguments indicative of proof-of-concept or exploitation tooling from the 'exploitarium' repository.
Detects the spawning of shell or scripting processes from IDEs, code editors, or AI-assistant processes (e.g., 'claude', 'node'). The rule specifically flags potential reverse shell patterns or dangerous command-line flags often used during development or exploitation, such as '--dangerously-skip-permissions'.
This rule detects suspicious PowerShell script behavior that attempts to patch the Anti-Malware Scan Interface (AMSI) in-memory by manipulating internal .NET/CLR methods. It identifies the combination of dangerous API calls (e.g., VirtualProtect, Marshal.Copy, PrepareMethod) typically used to bypass AMSI scanning via JIT compilation patching targeting the WinScanContent method.
Detects the execution of PowerShell scripts attempting an in-memory AMSI bypass by patching the AMSI scan content handler. The rule identifies suspicious combinations of .NET reflection and memory protection APIs (such as RuntimeHelpers.PrepareMethod, VirtualProtect, and Marshal.Copy) commonly utilized to overwrite AMSI function pointers or return values during runtime.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by nulling the pAppName pointer in memory using Marshal.WriteInt64. This technique forces AmsiScanBuffer and AmsiNotifyOperation to return E_INVALIDARG, causing them to fail open and skip security inspection.
This rule detects potential attempts to disable Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 using reflection-based manipulation of the amsiInitFailed boolean field in the System.Management.Automation.AmsiUtils class. Attackers often use obfuscation techniques such as splitting strings or using reflection methods to bypass static security signatures.
This rule detects when processes other than known web browsers (Chrome, Firefox, Edge, Opera) attempt to access sensitive browser-related files such as 'Login Data', 'Cookies', and database files. It specifically flags instances where the accessing process or its parent process originates from 'C:\ProgramData' or where the parent process is 'powershell.exe', which is a common pattern for malicious credential access tools.
Detects a process that is not a standard office, browser, or system application accessing a high volume of document files (doc, docx, pdf, xlsx, xls, pptx, txt, odt) within user directories over a short time window. This behavior is indicative of potential automated file collection or data staging by unauthorized processes.
Page 779 of 1168