Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,310 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects the execution of Impacket tools from a specific portable bundle path ('mini_imp/') often utilized by the threat actor MexicanMafia during 'Operation Escaneo'. The activity involves Active Directory enumeration and reconnaissance of service accounts, including those associated with SQL services, Citrix administrators, and CyberArk vault operators.
Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.
Detects network requests involving a file named 'cors_exploit_poc.html' in either the URL or the Referrer field. This filename is characteristic of proof-of-concept (PoC) code used to test for vulnerabilities in Cross-Origin Resource Sharing (CORS) policies, which could allow unauthorized cross-domain access to sensitive data.
Detects the execution of known offensive security toolkits commonly used for Active Directory enumeration and exploitation, including Impacket (mini_imp) and BloodHound/SharpHound. The rule monitors for command-line arguments and file creation artifacts associated with these tools.
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.
Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.
Page 963 of 1168