Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Detects the threat actor abusing ntdsutil.exe to create an Install From Media (IFM) dump of the Active Directory database for offline credential cracking.
Detects CastleLoader generating campaign-specific Named Mutexes to prevent multiple instances from running concurrently on the compromised host. The rule specifically looks for mutex creation events initiated by Python processes where the mutex name contains keywords associated with CastleLoader campaigns like 'Castle', 'Background', 'ClickFix', or 'TrapPhone'.
Correlates the use of Impacket scripts (wmiexec.py or smbexec.py compiled variants) executing remote commands via WMI or SMB services on target endpoints. Specifically looks for 'wmiprvse.exe' or 'services.exe' initiating 'cmd.exe' or 'powershell.exe' with command-line arguments indicating local host or administrative share access and redirection to a temporary directory.
Identifies the creation of named pipes matching standard Cobalt Strike malleable C2 profiles (\pipe\msagent, \pipe\postex, \pipe\status, \pipe\spoolss) that are associated with network activity, indicating advanced C2 deployment.
Identifies the creation of an Exchange transport rule or mailbox setting that forwards all incoming emails to an external, attacker-controlled address.
This rule detects attempts to register a new Authenticator app or phone number for multi-factor authentication (MFA) from an IP address that is not typically associated with the user's sign-in behavior. This could indicate a compromised account where an attacker is attempting to establish a new MFA method to maintain access.
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Page 849 of 1168