Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,362 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
Detects unexpected shell or script interpreter processes (e.g., sh, bash, python, perl, nc, curl, wget) spawned as children of media processing applications like ffmpeg or ffprobe, especially when running under service accounts associated with Jellyfin, Nextcloud, or Emby. This behavior could indicate exploitation of a vulnerability (e.g., CVE-2026-8461 / PixelSmash) allowing arbitrary command execution.
Detects email-based phishing attempts impersonating Scotiabank where the sender display name contains 'Scotiabank' but the actual sending domain is not 'scotiabank.com'. The rule specifically looks for emails with SPF and DMARC pass but missing DKIM pass, combined with suspicious subject lines (e.g., 'interac', 'e-transfer', 'unauthorized') or specific IP addresses/GoDaddy infrastructure indicators, and targeting high-value recipients (CFO, finance, etc.). This pattern is consistent with compromised legitimate small-business domain abuse.
This rule detects a potential Azure storage account name hijacking scenario. It identifies instances where a storage account is deleted and then recreated with the exact same name in a different subscription within the same Azure tenant, all within a 60-minute window. This activity could indicate an attempt to exfiltrate data via Azure Monitor diagnostic settings by taking over a previously used storage account name.
Detects the use of 'net.exe' to create or modify user accounts, specifically looking for commands that include 'user', 'admin', and '/add'. This could indicate an adversary establishing persistence or escalating privileges by creating new administrative accounts.
This rule detects the presence of components associated with the MYRA rootkit, including specific filenames ('libcache.so', 'memfd_loader') and references to the 'apintergrationpost' npm package or the author 'kimijohn01'. It monitors process command lines, file events, and syslog messages for these indicators.
Detects a potential S3 bucket hijacking attempt where an S3 bucket is deleted and shortly after, an AWS Firehose delivery stream is created or updated to target a bucket with the same name, but under a different AWS account. This could indicate an adversary attempting to exfiltrate data by redirecting data intended for the original bucket to their own controlled bucket.
Detects the installation of the OpenSSH Server feature or the creation of an 'sshd' service on Windows workstations. Adversaries may install OpenSSH as a persistent, covert backdoor to maintain access to a compromised host.
Detects unauthorized file read activity by node.exe targeting browser-based crypto wallet vault files, specifically 'Local Extension Settings'. This behavior is consistent with infostealer malware (such as Miasma/MYRA) using malicious JavaScript payloads to harvest sensitive encrypted vault data from developer environments.
Detects anomalous frequency of UAC elevation prompts (consent.exe) initiated by PowerShell. This behavior is indicative of privilege escalation attempts, specifically matching the pattern of repeated Start-Process -Verb RunAs usage to solicit user interaction for UAC elevation.
Page 926 of 1168