Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network, process, or command-line activity associated with the installation or update of malicious Chrome extensions linked to the BadBlocker campaign. The rule specifically monitors for known extension IDs: cmedhionkhpnakcndndgjdbohmhepckk (Adblock for YouTube), onomjaelhagjjojbkcafidnepbfkpnee (Adblock for Chrome), gekoepiplklhniacchbbgbhilidiojmb (AdBlock Suite), and ogcaehilgakehloljjmajoempaflmdci (Adblock for You).
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Tracks network communication matching specific ClickOnce deployment URLs traversing over unencrypted HTTP. This rule identifies attempts to download or access ClickOnce application deployment files (.application) over unencrypted HTTP, which could indicate a potential supply chain attack or malware delivery mechanism.
Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
Detects the use of the 'chmod' command to modify file permissions on critical system directories or files such as /etc/passwd, /etc/shadow, and various log directories. This activity is often indicative of an adversary attempting to facilitate privilege escalation, maintain persistence, or hide malicious artifacts.
Detects the scope-squatted package preinstall script executing the Claude CLI to harvest the developer's authenticated session email. Specifically, it looks for 'node.exe' as the initiating process, executing a process named 'claude' or a process with 'auth' and 'status' in its command line.
Detects suspected Browser-in-the-Middle (AiTM) activity by identifying successful multi-factor authentication followed by session activity from a different source IP address or with a different user-agent string within a 10-minute window, suggesting token theft or session hijacking.
This rule detects activities associated with specific malicious browser extensions, often masquerading as ad blockers. It monitors for file and command-line references to the unique extension IDs associated with these malicious payloads and also alerts on DNS requests directed at C2 domains known to be used by these extensions.
High fidelity detection combining the specific firefx-* staging directory pattern with the .vmxx shellcode file extensions, indicative of Operation XENOFISCAL activity. This rule identifies the creation or modification of files with '.vmxx' extension or specific filenames ('ayui.vmxx', 'ayhui.vmxx') within a suspicious 'C:\Users\Public\firefx-[a-f0-9]+-[0-9]+\' directory pattern, which is known to be used by the SideCopy threat group.
Page 968 of 1168