Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,293 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects suspicious patterns within the search query parameters of Microsoft Copilot and M365 search requests, indicative of potential prompt injection, data exfiltration, or exploitation attempts through malicious URL parameters.
Detects the execution of 'msiexec.exe' where the installer package is located in suspicious or user-writable directories such as AppData, Temp, or Downloads. It specifically targets MSI files that do not follow standard naming conventions or use suspicious filename patterns, which is a common indicator of dropper or delivery behavior by adversaries.
Detects Python interpreter activity associated with the LegionLoader malware, specifically monitoring for Python execution from within the 'AppData\Roaming\Traiolx' directory, or outbound network connections from Python processes to known malicious infrastructure such as 'birdeemusic.com' or other suspicious outbound HTTP/HTTPS communication.
Detects incoming emails with specific subject lines or attachment names relating to 'distribution settlement agreement' or 'agreement settlement' that arrive as PDF attachments. The rule calculates a risk score based on sender domain reputation (known malicious), DMARC/DKIM authentication mismatches, and potential display name spoofing to identify phishing attempts.
Identifies the execution of WindowsBackstageShell.exe used to create the invisible alternative desktop environment, as observed in Operation SilentCanvas.
Identifies the addition of the 'Visual Studio Code Tunnel' value under the HKCU Run key, establishing a persistence mechanism. This could indicate an attacker attempting to maintain access to a compromised system by ensuring Visual Studio Code Tunnel starts automatically.
Detects persistence via registry modification commonly associated with RomCom adversary activity (e.g., Mythic, SnipBot, MeltingClaw) post-CVE-2025-8088 exploitation.
Detects the use of rclone, MEGAcmd, or common command-line tools like curl/wget to transfer data to known cloud storage endpoints (mega.nz, gofile.io, anonfiles, pixeldrain) when initiated from non-standard system paths (i.e., not 'C:\Program Files'). This rule aims to identify data exfiltration activities, particularly those associated with the Qilin threat actor's double extortion tactics.
Detects incoming emails that claim to be from a 'Monitoring' display name associated with the gasparinutrition.com domain or specific accounting sender address, which may indicate a spearphishing or impersonation attempt.
Detects the execution of files with .exe, .msi, or .bat extensions located within the user AppData Roaming directory. This path is frequently abused by malware, droppers, and persistence mechanisms to execute code in a directory that is typically writable by the user without requiring elevated administrative privileges.
Page 978 of 1168