Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects AI-generated phishing campaigns characterized by a high degree of attachment polymorphism. It identifies instances where a single campaign (based on sender domain or subject schema) delivers HTML attachments with a unique SHA256 hash to each recipient, indicating an attempt to evade traditional signature-based detection.
Detects network communication from processes to known ClickFix autoupdate domains such as 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com'. This activity could indicate the presence of unwanted or malicious software attempting to update itself.
Detects network traffic fetching device codes from the Kali365 backend, specifically targeting the '/api/device/start' or '/api/device/status/' endpoints. This activity is associated with the EvilTokens device code phishing kit.
Detects phishing emails utilizing Kali365's hardcoded subject line templates impersonating file sharing services like SharePoint and DocuSign. The rule specifically looks for emails with subjects starting with "SharePoint - Document Shared:" or "DocuSign - Signature Required:" where the sender's domain is not microsoft.com or docusign.com, indicating a potential spoofing attempt.
Identifies an interactive logon session established from a RedVDS IP executing PowerShell downloaders to pull secondary payloads. This rule correlates process execution events for PowerShell with specific command-line patterns indicative of downloading content (Net.WebClient or DownloadString) with interactive logon events originating from a known RedVDS IP address.
Identifies DNS queries sent to unauthorized external DNS resolvers (rogue IPs instead of corporate/ISP assigned servers).
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.
Identifies package managers (npm, pip) executing pre-install scripts that perform immediate system reconnaissance (whoami, hostname, sw_vers, systeminfo) characteristic of Void Dokkaebi payloads. This rule looks for a sequence where a package manager initiates a process, and that initiated process then launches a reconnaissance command.
Page 882 of 1168