Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,414 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized access attempts to ServiceNow Scripted REST APIs, specifically targeting misconfigured endpoints that do not require authentication. This rule monitors for requests made by the 'guest' user, known malicious IP addresses, or requests missing authorization headers directed at potentially vulnerable APIs like 'related_list_edit'.
Detects behavior patterns associated with Payouts King ransomware, including direct syscall-style API calls (NtAllocateVirtualMemory, NtWriteVirtualMemory, CreateRemoteThread) from processes other than trusted system binaries, and the loading of ntdll.dll from non-standard file paths (outside System32/SysWOW64). It also includes a hash-based detection for known Payouts King malicious samples.
Detects the creation of local user accounts on macOS using the 'dscl' command-line utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.
This rule detects suspicious memory manipulation and thread injection activities directed at 'svchost.exe' or 'explorer.exe' by processes other than standard system components. Such behavior is often indicative of malicious code injection, where an attacker attempts to run arbitrary code within the address space of trusted system processes to bypass security controls or achieve persistence.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
This rule monitors for unauthorized changes to sensitive system, authentication, and configuration files, as well as the deletion or truncation of logging artifacts on SD-WAN appliances. This activity is indicative of an adversary attempting to modify credentials, evade detection, or clear their footprint by tampering with security-critical paths.
Detects session hijacking attempts where a session cookie is used from a different IP address or user-agent immediately following a successful MFA authentication event. This behavior is indicative of an adversary replaying a stolen session token.
Detects process command lines containing references to sensitive Unix system files (/etc/passwd or /etc/shadow) specifically when accessed within or in association with a /troot/ directory path. This pattern is often indicative of an adversary performing reconnaissance or credential dumping.
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
Page 888 of 1168