Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects activities related to Operation Escaneo, specifically focusing on the creation, modification, or access to cleartext credential harvesting files (e.g., vpn-passwords.txt) and the execution of associated Python scripts (forti_login2.py, forti_login3.py) used for credential staging and extraction on FortiGate systems.
Detects the creation or modification of a file named 'System.dll' within a subdirectory of the 'C:\Windows\Temp' directory where the writing process is not signed by Microsoft. This behavior is indicative of potential DLL sideloading or masquerading attempts, where an attacker drops a malicious DLL in a writable directory to be loaded by a legitimate process.
Detects the use of Wscript.exe or Cscript.exe to spawn wmic.exe with arguments indicative of remote WMI execution, such as 'Win32_Process', 'process call create', or '/node:'. This pattern is frequently associated with lateral movement, worm propagation (like VBScript-based malware), and ransomware deployment.
Detects various methods employed by LCRYX ransomware to disable security software and firewall configurations. The rule identifies suspicious process executions, including PowerShell commands to modify Windows Defender settings, netsh commands to disable firewalls, sc.exe commands to stop security services, and the termination of various antivirus processes (e.g., MsMpEng.exe, avp.exe, bdagent.exe) via taskkill. It specifically monitors these actions when spawned from script hosts like wscript, cscript, or shells like powershell and cmd.
Detects unauthorized OS command execution initiated via Oracle DBMS_SCHEDULER jobs, often involving UTL_FILE for output retrieval. This behavior is indicative of RCE attempts against database servers.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
Detects instances where CefSharp.BrowsersSubprocess.exe or processes within the SCef.WindowsAdapter folder load the iphlpapi.dll library, combined with command-line arguments indicative of network configuration discovery, such as retrieving MAC addresses, BSSIDs, or default gateways. This activity suggests potential reconnaissance by an application or a process masquerading as a browser component.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail).
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
Page 964 of 1168