Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,393 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of VILE ransomware by identifying specific strings indicative of its presence in command lines, alongside the usage of direct NT system calls (e.g., NtCreateWaitCompletionPacket) and low-level runtime artifacts often utilized by Go-based binaries to bypass user-mode EDR hooking mechanisms.
Detects the execution of VILE ransomware by identifying specific Go runtime and malware-specific strings in the command line. The detection logic focuses on artifacts related to sandbox and debugger evasion techniques, such as breakpoint trap detection, memory checks, and inspection of the Process Environment Block (PEB) via 'RtlGetCurrentPeb', as well as internal identifiers associated with the VILE ransomware binary.
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.
Detects the presence of debugger context strings indicative of Makop's loader exception triggering, specifically looking for '.cxr ' or 'dump context' in the process command line. This behavior is often associated with anti-analysis techniques used by malware like Makop Ransomware to detect and evade debugging environments.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects vLLM processes spawning Windows shells (cmd.exe, powershell.exe, pwsh.exe) if hosted in a Windows context, indicating potential exploitation of CVE-2026-22778 for remote code execution.
Detects shell commands querying attacker-controlled domains disguised as Apple driver stores to fetch malicious macOS backdoors, specifically looking for 'coreaudiod' or 'audio-issue-fix.sh' in the URL.
Detects network connections to specific IP addresses associated with websocket protocols
Page 905 of 1168