Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Tracks the Kali365 tool iterating through the victim's inbox, performing mass mail item reads or API-driven exports of mailbox contents.
Detects suspicious reconnaissance activity involving multiple common Windows discovery tools (nltest, net, dsquery, ipconfig, whoami, systeminfo) executed within a short time window (5 minutes) that was preceded (within 30 minutes) by a command shell (powershell.exe or cmd.exe) spawned by a web browser or common script-based execution engine (e.g., mshta.exe). This pattern is indicative of a post-exploitation phase where an attacker, having gained execution via a browser-based delivery method, performs environment discovery.
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
This rule identifies potential session hijacking or session replay attacks by detecting successful logins from the same user account using the same User-Agent string but originating from different source IP addresses within a one-hour window. This behavior is indicative of an attacker replaying stolen session cookies, effectively bypassing Multi-Factor Authentication (MFA) requirements associated with initial authentication.
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Detects the use of the Windows attrib.exe command with the +h (hidden) attribute flag applied to files within the AppData\Roaming or AppData\Local directories. This behavior is commonly associated with malware attempting to hide malicious components for persistence or evasion.
Detects anomalous AWS API activity immediately following a successful ConsoleLogin event for the same user. This behavior is indicative of a session replay attack, often associated with AiTM phishing kits like PoisonSeeds, where a victim's session cookie is harvested and immediately reused by an attacker to programmatically access the AWS environment.
Page 783 of 1168