Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of ffmpeg with the '-decoders' flag to enumerate available decoders, specifically looking for the vulnerable MagicYUV decoder. It also identifies 'grep' commands searching for 'magicyuv' in process command lines, which could indicate reconnaissance or triage activity related to CVE-2026-8461.
Detects the PowerShell downloader stage of the abdrizak PostCSS typosquatting campaign. The malware decodes an AES-encrypted blob in the npm package and executes powershell with ExecutionPolicy Bypass targeting settings.ps1, or invokes curl.exe (from node.exe or powershell.exe) to download a payload from nvidiadriver.net disguised as a Windows driver update.
Detects archiving utilities (WinRAR, 7z, zip) executing via command line to recursively compress sensitive user directories (Desktop, Documents, Downloads) into staging folders, which is a common technique for data exfiltration.
Identifies the creation of network scanning tools (e.g., Advanced IP Scanner, Netscan) within SimpleHelp cache directories, which could indicate a threat actor staging tools for reconnaissance.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
This rule detects Python or Node.js processes aggressively accessing directories associated with cryptocurrency wallet browser extensions like MetaMask, Phantom, and Binance Chain. This activity is indicative of information stealer malware attempting to exfiltrate sensitive wallet data.
Detects the W2 Malvertising loader waiting for the EDR to be killed before performing cross-process injection (Process Hollowing) into a new legitimate binary. This rule correlates the loading of a new, non-Windows driver with subsequent process memory injection within a 5-minute window, indicating potential BYOVD (Bring Your Own Vulnerable Driver) attacks followed by in-memory malware execution.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Identifies the GhostSocks tunneling binary (or Go/Python equivalent) executing and establishing a SOCKS5 relay to an external node. This rule correlates process command line arguments indicative of GhostSocks or SOCKS5 server/relay/listen functionality with network connections on common SOCKS proxy ports (1080, 1081, 9050).
Page 879 of 1168