Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
This rule monitors for the execution of known exploit scripts targeting MyBB forum software. It specifically detects the use of 'mybb_limited_acp_to_admin.py', as well as Python and PHP processes executing command lines that contain indicators of MyBB administrative control panel (ACP) exploitation, such as unauthorized user creation with administrator privileges (gid=4).
Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Detects signs of active exploitation of the PHP857 vulnerability. The rule identifies suspicious behaviors associated with this RCE, including the spawning of shells by PHP processes, access to sensitive memory maps (/proc/self/) for ASLR bypass, and the creation of specific indicator files or execution of proof-of-concept strings.
Detects the deletion of volume shadow copies via vssadmin or wmic, removal of the Windows backup catalog using wbadmin, and the disabling of system recovery boot settings via bcdedit. This activity is consistent with pre-encryption preparation behavior observed in Akira ransomware attacks.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
Page 864 of 1168