Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,416 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the sudo phishing routine writing the XOR-encoded stolen macOS user password to the hidden ~/.zsh_cache file.
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers.
Detects the execution of Impacket framework scripts (secretsdump, ntlmrelayx, psexec, wmiexec, smbexec) from a portable directory path named 'mini_imp'. This pattern is associated with credential dumping from LSASS and unauthorized lateral movement activities, similar to those observed in Operation Escaneo.
Detects LCRYX ransomware components executing via wscript.exe or cscript.exe to download secondary malicious payloads using MSXML2.ServerXMLHTTP and ADODB.Stream, targeting the C:\Windows\ directory. The rule matches on specific C2 domains/IP addresses and known file drop paths associated with multi-stage malware infections.
Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.
Detects anomalous process execution patterns originating from SAP system processes or accounts, such as SAP work processes spawning shell commands, usage of known RCE-related scripts, and privileged accounts like WF-BATCH or TMSADM invoking administrative command-line tools.
Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.
Detects a suspicious command line execution from explorer.exe involving syswow64\cmd.exe with specific variable substitution obfuscation patterns often associated with APT37's LNK-based NarwhalRAT delivery. The rule correlates this command execution with the subsequent launch of Python or userscreen.exe within a 5-minute window, a pattern indicative of second-stage payload delivery.
Detects the use of WScript or CScript (Windows scripting engines) to launch commands intended to disable or tamper with security products, including Windows Defender, system firewalls, Bitdefender, and Kaspersky antivirus solutions.
Detects suspected NarwhalRAT activity where a process (e.g., userscreen.exe or pythonw.exe in suspicious locations) communicates with the pCloud API to resolve a dead-drop location, followed within 60 seconds by a beacon connection to a different remote IP, characteristic of C2 communication.
Page 883 of 1168