Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,594 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous authentication behavior consistent with an Adversary-in-the-Middle (AiTM) attack, where a single user account triggers multiple MFA challenge requests from distinct source IP addresses within a two-minute window. This behavior is indicative of an adversary proxying authentication requests in real-time between the user and a legitimate service.
Detects the creation of an executable in the user's AppData\Roaming directory followed by the modification of a Windows Registry 'Run' key to point to that executable. This behavior is associated with the TuglaInsaatci loader, which uses this pattern for persistence.
Detects the spawning of suspicious shell processes (sh, bash, cmd.exe) by media processing applications like ffmpeg, ffprobe, jellyfin-ffmpeg, jellyfin, or nextcloud. This activity is often indicative of an adversary exploiting a vulnerability in these applications to gain initial access or execute arbitrary commands, potentially leading to further compromise. The rule specifically looks for suspicious command-line arguments that suggest interactive shells, network connections, or direct command execution.
This rule detects Python spawning native OS command utilities such as 'systeminfo.exe', 'whoami.exe', and 'ipconfig.exe'. The detection logic specifically looks for at least two distinct reconnaissance commands executed by the same Python process within a one-minute window, indicating potential victim profiling for a C2 panel, as observed in OpenClaw campaigns.
Tracks network connections from non-browser processes that transmit an abnormally large volume of outbound bytes, indicating active data exfiltration. This rule specifically excludes common browser processes (chrome.exe, msedge.exe, firefox.exe) and OneDrive (onedrive.exe) to reduce false positives. It aggregates outbound network activity over 10-minute intervals and flags any instance where the total outbound bytes exceed 100MB.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
This rule detects cross-process memory allocation, memory writing, and thread creation activities targeting critical Windows processes like svchost.exe or explorer.exe. Such actions are commonly utilized by attackers for code injection (e.g., Payouts King tradecraft) to execute arbitrary code within the context of trusted processes, enabling evasion or persistence.
Page 784 of 1168