Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,317 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the use of 'curl.exe' with specific command-line arguments indicating a SOCKS5 proxy connection to 'localhost:9050' and a request to '/recvf.php'. This pattern is often associated with malware or adversary activity attempting to exfiltrate data or establish C2 communications through a local SOCKS proxy, potentially part of a multi-hop proxy chain.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
Detects evidence of anti-debugging techniques commonly associated with VILE Ransomware. The rule monitors process information including command lines, descriptions, and file paths for strings such as 'RtlGetCurrentPeb', 'taggedPointerPack', 'gcstoptheworld', and specific ransomware-related markers, indicating that a process is attempting to detect or evade analysis environments.
This rule monitors for specific registry modifications to the Windows LegalNoticeText key, which is a known behavior of Pay2Key ransomware to display ransom notes to the user upon logon.
Detects VirtualProtect API calls that change the memory protection of ntdll.dll to PAGE_READWRITE. This behavior is commonly associated with EDR unhooking techniques where malware removes hooks placed by security products to monitor system API calls.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
Detects specific registry queries related to 'en-US' custom locale checks, often used by Grixba (Play Ransomware) to identify and evade sandbox environments. The rule also filters for process names matching known Grixba execution patterns or suspicious locations such as Public Music directories.
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Page 950 of 1168