Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Detects command-line execution or file events indicative of BeepRAT C2 framework activity, specifically targeting screen capture and thumbnail streaming commands derived from DcRAT plugin behavior.
Detects activity associated with the BeepRAT keylogger plugin by monitoring for specific command-line strings and file artifacts identified in the DcRAT-derived BeepRAT framework.
Detects anomalous child process execution by RustDesk, including shell spawning (cmd, powershell, etc.) or internal session-related process manipulation which may indicate unauthorized remote control, session hijacking, or exploitation of proof-of-concept permission bypass tools.
Detects instances where the 7z.exe process launches an executable or script file, often indicative of an adversary bypassing Mark-of-the-Web (MotW) protections by manually extracting malicious payloads from a downloaded archive.
This rule detects the creation of a specific file named 'linux-process-env.json' on Linux endpoints. The creation of environment-related configuration files in unexpected locations or by unauthorized processes may indicate reconnaissance, staging of malicious configuration, or post-exploitation activities by an adversary.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects the execution of Node.js processes initiated by or related to the Flowise low-code AI platform, specifically where the --require flag is used. This pattern may indicate the loading of arbitrary JavaScript code or modules into the Node.js runtime, which could be indicative of malicious code injection or exploit activity within the Flowise environment.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
Page 984 of 1168