Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,382 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of the Python interpreter (python.exe) from within the globally writable C:\Users\Public\ directory. Threat actors often drop bundled Python environments to bypass the requirement for a pre-installed interpreter when running Python-based malware, such as information stealers.
Detects curl.exe downloading payloads to generic .dat or .exe files in AppData, or hitting known staging IPs.
Identifies an Azure Active Directory (AAD) sign-in using a session token from an anomalous location accessing Workday/ADP SSO endpoints. This rule specifically looks for non-interactive sign-ins to Workday or ADP applications where the user's sign-in locations change rapidly (multiple distinct locations within a 10-minute window), which could indicate a session cookie hijack.
This rule detects automated script interaction with HR portals by correlating headless browsers or rapid HTTP POST requests sequentially navigating payroll endpoints. Specifically, it looks for network connections to URLs containing 'workday' or 'adp' initiated by 'python.exe' or 'curl.exe'.
This rule detects instances where 'python.exe' aggressively accesses files within '.ssh' directories. This behavior could indicate an attempt to harvest SSH keys, which are critical for secure remote access.
Identifies LLM API interaction followed shortly by the execution of Impacket tools (wmiexec.py, smbexec.py), simulating attackers using AI to formulate lateral movement commands.
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Detects the invocation of vssadmin.exe with command-line arguments to delete all volume shadow copies silently, a common tactic used by ransomware to prevent system recovery.
This rule detects validly signed executables making HTTP POST connections, which could indicate data exfiltration or command and control (C2) communication by a signed dropper. It correlates network events with image load events to identify processes with valid signatures performing HTTP POST requests.
Page 914 of 1168