Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,055 copies47 likes38,404 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects potential SharkLoader persistence mechanisms where a registry 'Run' key is modified to execute a file located in AppData or ProgramData, or containing a base64-encoded command. The detection correlates the registry modification with a recent file creation event of the referenced file in the same directory paths on the same host.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Detects high-privilege access to the LSASS process (lsass.exe), commonly associated with credential dumping techniques such as LSASS memory reading. The rule monitors for specific process access masks (0x1010 and 0x1fffff) originating from non-system, non-security tool processes.
Detects potential Remote Code Execution (RCE) in an AutoGen Studio environment by correlating an unexpected outbound network connection from the AutoGen process to an external endpoint, followed by the immediate spawning of a command interpreter (shell) child process containing common command-line interface indicators (e.g., whoami, curl, wget, encoded PowerShell).
Detects a potential OS command injection attack targeting AutoGen Studio. The rule correlates a suspicious WebSocket connection to the Model Context Protocol (MCP) endpoint on localhost:8081, specifically containing the 'server_params' parameter, with a subsequent shell process spawning from an AutoGen Studio, Python, or Uvicorn parent process. The shell command line includes common injection characters (e.g., ;, |, &&, ||) and OS enumeration commands (e.g., whoami, id, net user).
Detects a potential Remote Code Execution (RCE) chain originating from AI orchestration frameworks (such as AutoGen/Uvicorn). The rule identifies an execution flow where an AI framework launches a browser automation process (e.g., Playwright/Chromium), which subsequently spawns a suspicious OS shell or LOLBin (Living-off-the-Land Binary) that immediately initiates an external network connection. This behavior is indicative of an AI agent being coerced to bypass security controls via MCP (Model Context Protocol) WebSocket loopback trust, leading to command execution and external C2 communication.
Detects the execution of a process named 'wusvc.exe' located outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. Attackers often rename malicious binaries to look like legitimate system services (such as Windows Update service) to evade detection and maintain persistence.
Detects the loading of ntdll.dll or amsi.dll by the Windows Update Service (wusvc.exe). This pattern is often observed in the context of advanced techniques like SNOWLIGHT, which uses direct syscall table enumeration to bypass security controls. Monitoring for these modules in this specific process context can indicate memory-resident malicious activity or evasion attempts.
This rule detects unauthorized modifications to the Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Adversaries often replace or redirect these binaries to execute arbitrary code (often a backdoor or persistent access tool) with high privileges, typically triggered at the Windows login screen. The rule specifically looks for a 'debugger' registry value containing 'win_guard_'.
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
Page 899 of 1168