Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects specific malicious Chrome extension IDs executing JavaScript in the 'MAIN' world context of visited web pages. This behavior bypasses the browser extension's isolated execution sandbox by using 'chrome.scripting.executeScript' combined with malicious server-fetched 'scripletsRules' or the 'trusted-create-element' scriptlet, enabling full DOM access and potential credential theft or cross-site scripting.
Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.
Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).
This rule detects network activity associated with the Bluekit PhaaS (Phishing-as-a-Service) BitM (Browser-in-the-Browser) C2 infrastructure. It monitors for connections to known malicious domains, the use of WebSocket upgrades over TLS, and the presence of 'rrweb' (a DOM recording library) in request URIs, which are indicative of browser-in-the-browser phishing C2 traffic.
Detects network communication associated with the Bluekit phishing framework and the use of the rrweb library to capture web sessions, including WebSocket upgrade attempts which may indicate unauthorized user activity monitoring or credential harvesting.
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components (ConverterDDSNet.exe or SMEditor.exe) which are used to perform unauthorized screen capture and data exfiltration from the victim's host.
This rule detects potential browser fingerprinting activity or unauthorized WebRTC STUN requests, often associated with malicious landing pages, phishing, or automated detection evasion. It identifies the presence of specific browser API calls (RTCPeerConnection, navigator.deviceMemory, navigator.hardwareConcurrency) or suspicious use of STUN server ports (3478, 19302) on non-authorized domains.
Detects the STOCKSTAY/STOCKTRADER backdoor performing system discovery via WMI queries (Win32_OperatingSystem, Win32_Processor, or Win32_ComputerSystem). The detection identifies suspicious WMI activity originating from or associated with processes named after known Turla StockMarket components.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
Page 857 of 1168