Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects suspicious web traffic patterns associated with potential Cross-Origin Resource Sharing (CORS) exploitation. It monitors for access to files containing 'cors_exploit_poc', HTTP POST requests containing sensitive 'AMAUTHID' cookies, or the presence of 'withCredentials' headers alongside 'Access-Control-Allow-Origin' configurations. These indicators, particularly when combined, suggest unauthorized attempts to bypass browser-based security models to access sensitive session identifiers or data.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects the creation of known webshell filenames within web-accessible directories (such as wwwroot or CFIDE) by ColdFusion or IIS worker processes. This behavior is indicative of an adversary re-establishing persistence or re-compromising a web server through unauthorized file drops after initial exploitation.
Detects modifications to the Windows Registry designed to enable the WDigest authentication provider, which forces the storage of credentials in plaintext in memory. This is a common technique used by attackers to simplify credential harvesting using tools like Mimikatz.
Detects instances where ColdFusion service processes or IIS worker processes (w3wp.exe) spawn common command-line interface tools or system enumeration utilities. This activity often indicates post-exploitation behavior, such as a web shell being used to execute commands, perform system discovery, or establish persistent re-access after initial remediation.
Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.
Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
Page 966 of 1168