Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,420 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the installation of a malicious browser extension that impersonates the legitimate Perplexity AI service. The extension leverages a typosquatted domain ('perplexity-ai.online') and a specific extension ID to facilitate search hijacking and keystroke collection on the victim host.
Detects unauthorized modifications to the vmanage-admin password on Cisco SD-WAN Manager. This rule is designed to identify suspicious credential changes that deviate from standard administrative practices, potentially indicating an actor modifying the default admin credentials for persistence or unauthorized access before attempting to revert the changes to evade detection.
This rule detects the suspicious creation or modification of high-privileged accounts (Domain Admins, Enterprise Admins, Administrators) using net.exe or net1.exe. It triggers when these commands are executed via PowerShell or cmd.exe, originating from suspect parent processes (WmiPrvSE.exe, mstsc.exe, etc.), and specifically monitors for a pattern of creating the same new account across multiple distinct hosts within a short 30-minute window, excluding accounts that existed in the prior 24-hour baseline.
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects privilege escalation events (assigning special privileges or executing privileged operations) occurring on a host shortly after the execution of legitimate remote support tools such as Quick Assist or msra.exe. This pattern is consistent with social engineering campaigns where attackers gain remote access via support tools and then perform local privilege escalation.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility with the 'cl' command, the PowerShell 'Clear-EventLog' cmdlet, or by identifying specific system events (EventID 1102 and 104) that signify the security or system logs have been cleared.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Page 865 of 1168