Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the Windows Remote Desktop Client (mstsc.exe) spawned from an email client, browser, or archival application following the opening of a .rdp file attachment. This behavior is consistent with Turla's STOCKSTAY campaign, where malicious RDP configuration files are used to target sensitive entities.
Detects endpoint devices navigating through a sequence of two or more distinct cloud-native redirector platforms (specifically Azure Websites, Cloudflare Pages, and AWS S3 buckets) within a 5-minute window, followed by a connection to a non-cloud final destination. This behavior is highly characteristic of adversaries utilizing Traffic Direction Systems (TDS) or Bulletproof Redirect Engines to obfuscate malicious payloads and evade network security controls.
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
This rule detects a specific environmental keying pattern indicative of malware or reconnaissance tools attempting to identify hostnames and domain membership. It monitors for a sequence of activities occurring within a 30-second window: querying the registry for computer name configuration, executing a WMI query for system information, and querying environment variables. The detection further filters for processes that exhibit this behavior without subsequent network activity or child process creation, which is characteristic of 'silent' environmental keying techniques.
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
This rule detects potentially suspicious activity related to VS Code extensions or development environments, specifically targeting the creation of 'tasks.json' files by Node.js processes, or the spawning of suspicious child processes (such as shells or interpreters) by VS Code-related processes with command lines associated with common malicious patterns or unauthorized automation.
Detects Node.js processes launched via command line with potentially obfuscated or malicious code patterns. This includes the use of eval-like flags combined with JavaScript memory management or network-related library imports, as well as command lines containing unusually long hex-encoded strings or base64-encoded blocks often used by attackers to hide payloads.
Identifies the execution of MeshCentral for remote command execution, specifically looking for 'meshctrl.js RunCommand' in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters for staging payloads.
Detects the threat actor creating inbox rules to delete or archive emails containing keywords like "deposit", "payroll", "HR", "Workday", or "ADP" to hide their tampering, often associated with the Storm-2755 campaign.
Page 818 of 1168