Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects non-browser applications (Python, PowerShell, cURL, wget, node) communicating directly with OpenAI or ChatGPT API endpoints, indicative of automated AI tradecraft by threat actors. This rule specifically looks for network connections to api.openai.com initiated by these common scripting or command-line tools.
Detects brute-force tools (Hydra, NLBrute) originating from known RedVDS infrastructure IP ranges/ASNs, indicating cybercriminal VDI abuse.
Identifies a local device repeatedly attempting to access default router gateway IPs (192.168.1.1, 192.168.0.1, 10.0.0.1) on common web ports (80, 443) to brute-force admin passwords. The rule triggers if more than 20 attempts are observed within a one-minute window from a single device to a specific remote IP.
Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).
Detects a device attempting to resolve a legitimate Microsoft/Banking domain, but receiving a non-standard/malicious IP indicative of router-level DNS hijacking.
Detects emails containing embedded PNG, SVG, or JPG images (often QR codes) that are used in conjunction with a subject line indicating 'Code of Conduct' to bypass text-based URL filters and redirect users to an AiTM (Adversary-in-the-Middle) proxy. This technique is commonly used in phishing campaigns to steal authentication tokens.
Detects GreenBlood ransomware or similar threats accessing Outlook PST/OST/EML/MSG email files from non-Outlook processes, potentially indicating data theft for double extortion. The rule specifically looks for file read, access, or creation actions on these email file types within common Outlook or user data folders, excluding legitimate processes that typically interact with these files.
Detects attempts by the GreenBlood ransomware to disable Windows Defender's real-time monitoring by modifying the registry. This rule specifically looks for 'reg.exe' commands that add 'DisableRealtimeMonitoring=1' to the Windows Defender policy key.
Identifies AI agents (python.exe or node.exe) making outbound GET requests where sensitive local data is extracted and appended as URL parameters for exfiltration. This rule specifically looks for URL parameters like 'q', 'data', 'context', or 'query' containing at least 50 alphanumeric characters, underscores, or hyphens, while excluding legitimate API calls to OpenAI and Anthropic.
This rule detects two distinct but related network-based adversary-in-the-middle (AiTM) techniques. The first part identifies ARP spoofing by looking for the same IP address being claimed by multiple MAC addresses within a short time frame, which can indicate an attacker is attempting to intercept local network traffic. The second part detects TLS certificate pinning failures, which can occur when an attacker attempts to perform a man-in-the-middle attack by presenting an untrusted or modified TLS certificate to a client that expects a specific certificate (pinning). This is often indicative of an attempt to intercept or decrypt encrypted network communications.
Page 832 of 1168