Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,051 copies47 likes38,376 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where 'RemotePCService.exe' or 'rpccmdhost.exe' (associated with remote access software) spawn 'powershell.exe' with suspicious command-line arguments. These arguments often indicate attempts to execute obfuscated commands, download content from the internet, or execute code in memory, which can be indicative of malicious activity leveraging legitimate remote access tools.
This rule detects suspicious attempts to access macOS Keychain credentials using the 'security' command-line utility or 'osascript'. It specifically looks for 'security' commands attempting to find generic or internet passwords, unlock keychains, or target browser-specific safe storage keys (Chrome, Brave, Microsoft Edge). It also flags 'osascript' processes accessing Keychain paths. The rule excludes legitimate system and browser processes to reduce false positives.
Detects the native ClickOnce service host (dfsvc.exe) spawning interactive command shells, a direct indicator of exploitation.
Detects exploitation of CVE-2025-8088, where WinRAR writes a nested .vbs payload directly to the Startup folder via NTFS ADS path traversal.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).
Detects the ClickOnce payload attempting to spawn the UAC consent.exe dialogue to elevate its privileges post-install.
Page 927 of 1168