Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,601 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where msiexec.exe or related processes modify sensitive Windows Registry keys often associated with security settings, Internet Explorer configuration, or system identification. This behavior may indicate an attempt to tamper with security controls or prepare for further malicious activity.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
This rule detects when known DLL files (7z.dll or normaliz.dll) are loaded by a process from a file path containing 'Traiolx Custom Utils'. This pattern is often indicative of DLL side-loading or hijacking, where an adversary places malicious or proxy DLLs in a custom directory to be loaded by a legitimate application.
Detects instances where the svchost.exe process is associated with multiple occurrences of indicators categorized as 'Misc', potentially indicating malicious activity or process abuse that bypasses standard detection signatures.
This rule detects potential command and control (C2) activity by identifying specific DNS queries to known malicious domains or suspicious network-related processes executing on an endpoint. It flags DNS requests for 'birdeemusic.com' and network connections initiated by processes with names indicative of custom or potentially malicious payloads like '_socket.pyd' or 'Traiolx Custom Utils'.
Detects email thread fabrication by the Latin-placeholder phishing kit, which embeds specific, non-business job titles and recipient-domain email addresses into the message body to manufacture the appearance of legitimate internal correspondence.
Detects the execution of batch (.bat/.cmd) scripts located within the AppData\Roaming directory via cmd.exe. This behavior is indicative of LegionLoader multi-stage infection chains, particularly when initiated by msiexec.exe. Legitimate software update processes are excluded to minimize false positives.
Page 838 of 1168