Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule monitors network logs (proxy, DNS, network) for connections to domains associated with the Unistream SDK. This SDK has been identified as a component of the BadBlocker malicious Chrome extension family, which facilitates unauthorized background activity. The rule serves as an indicator of potential command and control (C2) communication from a compromised host.
Detects malicious code injection originating from compromised npm packages into developer tools such as Microsoft VS Code, Cursor, and GitHub Desktop, or the npm CLI. This rule monitors for suspicious process command lines involving socket.io-client, ss_eval, or axios, which are characteristic of the Miasma/Socket.io backdoor campaign.
Detects the execution of msiexec.exe spawned by WinRAR or unrar processes, specifically targeting the installation of STOCKSTAY payloads. This activity is indicative of exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088), where attackers extract malicious MSI files to unauthorized locations to bypass security controls and achieve code execution.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
This rule detects the execution of PowerShell or AutoHotkey processes that include 'RtkLoggingManifest.man' in their command line. This behavior is indicative of AsyncRAT attempting to reconstruct a hidden .NET executable payload by parsing integers from a fake manifest file.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Detects the initial ClickFix mechanism where a user is socially engineered into pasting a malicious script (Get-Clipboard) into the Run dialog (explorer.exe), which launches PowerShell to fetch the CastleLoader.
Page 782 of 1168