Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,408 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
Detects PowerShell execution with a highly suspicious command line containing common obfuscation techniques, the 'DownloadString' method, and a hardcoded IP address. This pattern is frequently observed in malware and adversary tooling to download and execute malicious payloads from a remote server.
Detects the execution of a process named 'servertool.exe' specifically when it originates from a user's OneDrive Music folder or a generic Music folder within the user profile. This could indicate an attempt to masquerade malicious activity by placing an executable in an unusual, typically benign location.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
This rule detects the presence and execution of the GLASSWORM.WASM TinyGo-compiled WebAssembly loader. It identifies suspicious file creations of .wasm files or known malicious JavaScript shim files within VS Code extension directories, as well as the execution of node.exe loading .wasm files or known malicious JavaScript shims from these paths. Detection is based on specific file names, folder paths, and a known malicious SHA256 hash.
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
This rule detects the execution of multiple system and file discovery commands within a short timeframe, which can be indicative of an adversary performing reconnaissance. The rule specifically looks for common Windows commands like 'systeminfo', 'whoami', 'ipconfig', 'net', 'tasklist', 'net user', 'net localgroup', 'wmic os get', 'wmic product get name', 'dir /s', 'Get-ChildItem', and 'Get-Process' executed via cmd.exe, powershell.exe, or wmic.exe. It triggers if at least 3 commands are executed or if at least 2 distinct tools are used within an hour.
This rule detects highly suspicious email attachments that mimic voicemail notifications, specifically targeting Scotiabank users. It identifies emails with attachments named like 'v-mail_*.mp3.eml' or ending with '.mp3.eml' where the attachment's MIME type is 'application/html'. The rule also looks for specific subject line keywords related to Scotiabank, Interac, e-Transfer, unauthorized activity, or a specific monetary value ('3,000'), and checks for an approximate file size of 6000-9000 bytes, consistent with known phishing lures.
Page 894 of 1168