Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,405 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
Detects the sc.exe utility creating a kernel-mode driver service pointing to a newly dropped .sys file in a temporary user directory. This activity is indicative of Bring Your Own Vulnerable Driver (BYOVD) techniques, often used by attackers to gain kernel-mode privileges and bypass security solutions.
Correlates the loading of a .sys driver with the subsequent rapid termination of security, EDR, and AV processes via the EDR Killer utility.
Detects the Havoc Demon utilizing execute-assembly to load post-exploitation .NET tooling (like Seatbelt or SharpHound) directly into memory without touching disk. This rule identifies processes loading 'mscoree.dll' (a .NET runtime component) and subsequently making network connections to non-localhost IP addresses, indicating potential in-memory .NET execution with C2 communication.
Uses time-series anomaly detection to identify a sudden, complete drop-off in DeviceEvents telemetry from a host immediately following a suspect driver load, indicating kernel-mode EDR blinding.
Detects AstarionRAT installing a global keyboard hook (SetWindowsHookEx) to capture user keystrokes. This rule relies on advanced API tracking telemetry to identify the SetWindowsHookExApiCall action type and then joins with process events to filter for executables running from the AppData folder.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects the execution of the SharpGPOAbuse utility or the use of its specific command-line arguments intended for manipulating Active Directory Group Policy Objects (GPOs) to achieve privilege escalation or persistence.
Detects the execution of common reconnaissance and discovery tools on Windows systems, including network and domain trust enumeration tools, and system information utilities. This rule alerts on suspicious usage of binaries like fscan, SharpGPOAbuse, and administrative commands (net, nltest, whoami, ipconfig) used to gather information about the environment, domain trusts, or local system configuration.
Page 895 of 1168