Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,603 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a potential Conditional Access bypass, often associated with Storm-2372, where a device is registered and immediately followed by a PRT or deviceToken-authenticated sign-in to sensitive cloud applications within one hour. This behavior indicates the usage of non-TPM-attested 'phantom' devices to circumvent device-based security requirements.
Detects a process performing a file access check for 'sbiedll.dll' (indicative of a Sandboxie presence check) followed by the immediate termination of the same process within a 2-minute window. This behavior is highly characteristic of malware attempting to detect if it is being analyzed in a sandbox environment and aborting execution accordingly.
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects the suspicious loading of 'msimg32.dll' by 'consent.exe' from non-standard directories, specifically targeting temporary folders often used by the Bumblebee malware loader. This behavior is indicative of DLL side-loading to execute malicious code within the context of a legitimate system process.
Detects anomalous activity involving the Windows consent.exe process, which handles User Account Control (UAC) elevation prompts. Specifically, this rule monitors for instances where consent.exe is spawned from the Temp folder, spawned by msiexec.exe from the Temp folder, or loads a suspicious version of msimg32.dll from a non-System32 directory. These behaviors are often indicative of UAC bypass attempts or DLL hijacking related to privilege escalation.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
Detects the use of the native Windows Backup utility (wbadmin.exe) to initiate a backup that specifically includes the Active Directory database file (ntds.dit). This behavior is characteristic of an attempt to perform offline Active Directory credential dumping by creating a backup of the database to an accessible location.
Detects execution of psql.exe with command line arguments containing 'VeeamBackup' and 'credentials', which may indicate an attempt to access or extract credentials from a PostgreSQL database associated with Veeam Backup software.
This rule detects the creation of files or directories associated with known suspicious or malicious browser extension IDs within the Microsoft Edge User Data folder. It monitors for the writing of new executables, scripts, or directory creation events that match specific, potentially malicious extension GUIDs.
Page 861 of 1168