Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,310 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
Detects DNS resolution of known Bluekit PhaaS (Phishing-as-a-Service) operator domains. These domains are associated with phishing lures that leverage LLMs for localized content and voice cloning, and this detection identifies when a host attempts to resolve these specific malicious domains, indicating a likely interaction with a phishing lure.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.
Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.
Hunts for PowerShell commands setting up the RijndaelManaged API in ECB mode, a cryptographic pattern used by AsyncRAT for C2 packet encryption.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Page 967 of 1168