Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous activities associated with the Zerologon (CVE-2020-1472) vulnerability. The rule identifies suspicious machine account password changes, NTLM authentication from potentially untrusted subnets or unconfigured workstations, and privilege escalation indicators occurring on domain controllers.
Detects potential Windows executable or DLL file downloads originating from or directed to a specific suspicious external IP address (154.49.70.216) over HTTP port 80, based on signature-based alerts from network security tools.
Detects modifications to the Windows Update registry keys that disable automatic updates. Attackers may perform this action to prevent the installation of security patches and maintain vulnerabilities on a compromised system.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
Detects the creation of an interactive shell (e.g., bash -i, Python pty, socat) on a Linux host that simultaneously initiates an outbound network connection to an RFC-1918 private IP address. This pattern is characteristic of attackers using reverse shells for command and control or internal network reconnaissance, specifically matching behaviors associated with the MYRA RAT shell-pty plugin.
Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.
Detects unauthorized access to browser-based credential stores (such as Cookies and Login Data for Chrome, Edge, and Firefox) by non-browser processes. This behavior is a common indicator of credential harvesting by infostealer malware, such as Vidar, attempting to exfiltrate session cookies and stored credentials.
Detects execution of the macOS.Gaslight Rust-based implant. The rule identifies the specific malicious binary by its SHA-256 hash and targets its behavior of using runtime dynamic symbol resolution (via dlsym) to hide API calls from static analysis.
Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).
Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.
Page 886 of 1168