Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
Detects suspicious registry queries and reads indicative of Reynolds ransomware performing system reconnaissance. This rule specifically looks for 'reg.exe query' commands targeting HKLM\SYSTEM\Setup, HKLM\SOFTWARE, HKLM\SYSTEM, and HKCU\SOFTWARE, as well as direct registry event monitoring for reads on 'OOBEInProgress' and 'SystemSetupInProgress' values within the HKLM\SYSTEM\Setup key, while filtering out common legitimate processes.
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
Detects the use of 'osascript' to display credential prompts or 'dscl' with authentication-related arguments, which could indicate an attempt to phish user credentials or enumerate/create accounts on macOS systems.
Detects Vidar Stealer attempting to enumerate browser processes (chrome.exe, msedge.exe, brave.exe) using the CreateToolhelp32Snapshot API call, often followed by Process32First/Next, to target memory for data exfiltration. The rule looks for processes initiating these API calls that are not common system or legitimate debugging tools.
Detects enumeration or modification of the AppModelUnlock registry key, specifically 'AllowDevelopmentWithoutDevLicense' or 'IsDeveloperModeEnabled', which are prerequisites for enabling Developer Mode. This activity is relevant to the UNCanny coercion primitive, which leverages loose-file UNC AppX package registration.
Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
Page 866 of 1168