Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects the modification of Windows registry run keys (HKCU or HKLM) by SystemSettings.exe or msiexec.exe. This activity is often associated with persistence mechanisms where an adversary attempts to maintain execution across system reboots by registering malicious code in startup locations.
Detects the execution of known credential dumping tools and techniques on Windows systems. This includes targeting LSASS process memory using procdump or rundll32 with comsvcs.dll, and attempts to extract NTDS.dit via ntdsutil, vssadmin, or diskshadow.
Detects the execution of 'fscan', a common command-line tool used by adversaries for network service discovery, port scanning, and vulnerability identification on a target host.
This rule detects instances where AutoGen Studio or related AI agents initiate potentially suspicious child processes such as command interpreters (cmd, powershell, bash) or known Living-off-the-Land Binaries (LOLBins) while simultaneously establishing outbound WebSocket connections to Model Context Protocol (MCP) endpoints. This behavior is indicative of an attacker attempting to leverage AI agent automation capabilities for code execution or remote system interaction.
Detects high-frequency execution of common Windows reconnaissance tools such as net.exe, nltest.exe, and dsquery.exe, often used by attackers for account or domain enumeration. The rule filters out known administrative processes and Microsoft-signed binaries to reduce noise.
Detects instances where the IIS worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other scripting tools. This behavior is a common indicator of web shell exploitation on internet-facing servers like Microsoft Exchange or SharePoint.
Detects the execution of known StrikeShark post-compromise reconnaissance tools, specifically fscan.exe and searchall.exe, as well as associated administrative commands used for domain group and trust discovery in Windows environments.
Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.
Page 819 of 1168