Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,053 copies47 likes38,393 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Generates a macro-level alert identifying a rapid influx of emails containing links routing through known AiTM reverse proxy architectures, specifically targeting domains like onrender.com, web.app, and workers.dev. The rule triggers if more than 100 such threats are observed within a one-hour window for a given URL domain.
Detects the threat actor executing net user /add and adding the account to the local Administrators group to maintain interactive access via RDP.
Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh, bash), immediately followed by reconnaissance or download tool execution (whoami.exe, ping.exe, certutil.exe, curl, wget) within a 2-minute window. This pattern is indicative of a web shell being used for initial system compromise and subsequent information gathering or tool deployment.
Correlates CI/CD runners utilizing AWS credentials to execute secretsmanager:ListSecrets or GetSecretValue outside normal parameters. This rule detects processes named 'aws' executing commands related to AWS SecretsManager, specifically 'ListSecrets' or 'GetSecretValue'.
This rule detects shell reconnaissance activities associated with the TeamPCP threat group. Specifically, it looks for commands that parse '/var/log/auth.log' for successful logins or execute 'env | grep AWS_' to find AWS credentials. This behavior is indicative of an attacker attempting to gather authentication information or cloud credentials from a compromised system.
This rule correlates the execution of the VS Code CLI ('code.exe') with the output redirection of a command prompt ('cmd.exe') to a temporary text file. This behavior is indicative of an attempt to scrape authentication codes, potentially for phishing or credential theft, specifically targeting the 'tunnel' functionality of VS Code.
Correlates WScript execution terminating early if analysis environments are detected, before transitioning to PowerShell. This rule identifies a pattern where 'wscript.exe' executes and is quickly followed by 'powershell.exe' within a two-minute window, suggesting a potential anti-analysis technique used by malware like Vidar to evade detection in sandboxed environments.
Correlates the exploited Bomgar service gathering and compressing large amounts of internal data into an archive file prior to egress. This rule specifically looks for Bomgar processes initiating archive creation using common archiving utilities like tar, zip, or 7z, with the command line indicating the creation of a .zip or .tar.gz file.
Detects the transition to the BackgroundFix stage, where a VBScript or JScript file dropped in %AppData% establishes persistence via the registry Run key and executes silently via WScript.
Identifies the BackgroundFix script invoking hidden PowerShell instances to retrieve updated payloads or auxiliary modules from the C2.
Page 911 of 1168