Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,298 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Correlates a successful login from RedVDS infrastructure followed immediately by massive internal directory reconnaissance (e.g., SharpHound execution). This rule detects when an account logs in from a RedVDS IP address and then within an hour executes a process associated with BloodHound or SharpHound for Active Directory reconnaissance.
Detects malicious payloads downloaded from a spoofed legitimate domain (e.g., downloading "update.exe" from a hijacked google.com). This rule specifically looks for 'google.com/update.exe' or 'microsoft.com/flash_update.exe' within the RemoteUrl field, indicating a potential attempt to deliver malicious software from a compromised or spoofed legitimate domain.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Detects modifications to .git/hooks/pre-commit files across developer workspaces, which is a primary persistence mechanism ensuring payload re-execution on git commits.
This rule detects the exfiltration of sensitive developer tokens (specifically .npmrc or .pypirc files) to public paste sites like Pastebin or GitHub Gists. It correlates network events where a process attempts to connect to these sites with file access events on the specified token files by the same process.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects the creation of ActiveScriptEventConsumer bindings via WMI process executions, a fileless persistence mechanism used by Showboat malware to survive reboots. The rule specifically looks for 'scrcons.exe' processes with command-line arguments containing 'ActiveScriptEventConsumer' or '__EventFilter'.
Detects an attempt to bypass User Account Control (UAC) consistent with the Millenium RAT. The rule monitors for the spawning of cmd.exe from non-standard, user-writable directories (such as AppData or Temp) where the parent process launches the shell using the runas verb via ShellExecuteExW with a hidden window, often accompanied by silent command execution.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
Page 971 of 1168