Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,595 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the creation of directories or files within the '\Temp\' directory that match a specific naming pattern ('RP_' followed by an alphanumeric string). This pattern is often associated with the creation of temporary artifacts by scripts, installers, or malicious payloads.
Detects successful remote logons (LogonType 3 or 10) to Windows systems using highly privileged accounts (admin, administrator, root, or service-specific accounts) where the source IP address is external to defined private network CIDR ranges. This pattern is indicative of potential unauthorized access or compromised credentials.
Detects a potential User Account Control (UAC) bypass by correlating registry value updates in the 'ms-settings' class with the subsequent execution of auto-elevating Windows binaries (fodhelper.exe, computerdefaults.exe, or sdclt.exe) from suspicious locations such as AppData or Temp directories.
This rule detects the creation of NTFS reparse points or junctions within temporary directory paths, often used by adversaries to bypass directory access controls or redirect file system operations. The rule identifies file creation activities occurring under paths matching a specific temporary folder pattern (RP_ followed by a hex string) and excludes legitimate system operations like wermgr.exe executions.
This rule detects potentially malicious use of Managed Service Provider (MSP) credentials by correlating network or explicit authentication events (Logon Types 3, 9, or 10) occurring outside of typical business hours or originating from VPN/private network ranges, with concurrent SSH process activity on the same host. This pattern suggests an adversary may be using compromised credentials to move laterally or persist within an environment via SSH.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
This rule detects the loading of ntdll.dll by processes executing from common temporary locations (e.g., _MEI* subdirectories used by PyInstaller or .cache/winupdate.exe). Such patterns are frequently associated with the execution of packed or obfuscated malicious payloads, often seen in droppers and loaders that unpack their contents to temporary paths before execution.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects instances where an unusual process (not a standard image viewer or web browser) reads a .png file and subsequently triggers a new process within a 5-minute window. This behavior is indicative of potential steganographic exploitation or hiding malicious code within image files, where a hidden payload is read and then executed.
Identifies anomalous session cookie replays where a user token is suddenly used from an entirely different geographic location or ISP within minutes. This rule specifically looks for non-interactive sign-ins (indicating session cookie reuse) where a single AccountUpn shows sign-ins from at least two different IP addresses and two different geographic locations within a 10-minute window.
Page 792 of 1168