Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects instances where the w3wp.exe (IIS worker process) spawns command-line interpreters like cmd.exe or powershell.exe, and these interpreters execute common discovery commands such as 'whoami', 'hostname', or 'ipconfig'. This behavior can indicate a web server compromise where an attacker is attempting to gain information about the compromised system or network.
Detects suspicious screen capture activity by non-UI processes. This rule identifies instances where a process invokes GDI BitBlt/PrintWindow or CopyFromScreen APIs, followed by writing a JPEG screenshot file to disk, particularly from temporary or program data folders. This behavior is consistent with infostealers like StealC and Amadey.
This rule detects network connections to Google API domains (oauth2.googleapis.com, accounts.google.com, or any *.googleapis.com on port 443) initiated by processes that are not common browsers or Google update/crash handler executables. The detection is further narrowed down to processes executing from 'AppData' or 'Temp' directories, or specifically 'vaultsvc.exe', which are often indicators of suspicious or malicious activity.
Detects network activity associated with the BadBlocker for YouTube browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk). The rule identifies DNS queries and outbound network connections to known command-and-control (C2) domains (api.adblock-for-youtube.com, get.adblock-for-youtube.com) used by the extension to exfiltrate session cookies and other sensitive browser data.
Detects network activity originating from popular web browsers (Chrome, Chromium, Edge, Brave) directed towards known malicious or suspicious browser extension domains. This rule flags beaconing, API requests, and remote configuration fetches associated with potentially malicious or unwanted browser extensions.
Identifies native network tools (curl.exe, wget.exe) using HTTP PUT or POST parameters to upload local archive files (zip, rar, 7z) directly to attacker-controlled IPs.
Identifies the EDR Killer utility deleting the vulnerable .sys driver and its associated service after the EDR has been permanently blinded. This rule specifically looks for 'cmd.exe' executing commands to delete services ('sc delete') or delete .sys files ('del *.sys'), combined with a driver load event for a .sys file.
Detects path traversal exploitation of WinRAR (CVE-2025-8088) where a malicious RAR archive extraction results in the creation of suspicious STOCKSTAY payload files (e.g., MicrosoftUpdateOneDrive.exe) outside of the expected or secure extraction directories, linked to Turla activity.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Page 781 of 1168