Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,414 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects MFA device registration occurring during a suspicious session heavily focused on HR portal access. This rule correlates MFA registration events with access to HR applications like Workday or ADP within a 10-minute window, indicating potential account takeover or unauthorized access attempts.
This rule detects successful user sign-ins from anomalous IP addresses, indicative of an Adversary-in-the-Middle (AiTM) reverse proxy attack. It correlates successful logins with the receipt of a phishing email containing specific subject keywords ('Code of Conduct') within a two-hour window, suggesting that the login was a direct result of the phishing lure.
Detects the execution of 'osascript' with command-line arguments indicative of a credential phishing attempt, specifically looking for prompts that display a dialog asking for a password with a hidden answer field. This is associated with the Sapphire Sleet threat actor's macOS intrusion techniques.
Detects the decoded execution of bash/sh reverse shells initiated from processes like node.exe or python.exe, which is indicative of the Void Dokkaebi threat actor's tactics. The rule specifically looks for command lines containing 'echo' with base64 encoded strings, followed by 'base64 -d' and then 'sh' or 'bash' for execution.
Detects attempts to exploit the Windows Search URI handler vulnerability (CVE-2023-29357) which can lead to NTLM credential leaks. This rule specifically looks for process command lines that invoke the 'search' or 'search-ms' URI scheme with a 'crumb=location:' parameter pointing to an UNC path, indicating an attempt to coerce NTLM authentication.
Detects file creation or process execution originating from or referencing a folder named 'GentlemenCollection', which is a known staging directory used by the Gentlemen RaaS EDR killer framework prior to ransomware encryption.
Hunts for newly installed applications in the ClickOnce directory cache signed by self-signed or explicitly untrusted certificates, specifically looking for process creation events where the initiating process is 'dfsvc.exe' and the signature is marked as 'Untrusted'.
Identifies network connections to algorithmically generated Cloudflare Workers domains used by Kali365, specifically targeting the `-s-account.workers.dev` format. This pattern is indicative of phishing campaigns, potentially for credential harvesting or token replay.
Detects Railway server OS leaking via User-Agent during automated token exchanges. This rule specifically looks for sign-in logs where the User-Agent string indicates a Linux x86_64 system and a Chrome browser version 145 or 146.
Detects the Python Imaging Library (PIL) memory leak used to bypass ASLR prior to the JPEG2000 heap overflow. This KQL query specifically looks for syslog messages containing 'cannot identify image file' and 'BytesIO object at 0x', which are indicators of this specific memory leak vulnerability being triggered.
Page 880 of 1168