Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,289 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Detects Codex writing extremely large, encoded script blocks directly into HKCU registry values to achieve fileless reboot persistence.
Identifies the creation of Named Pipes by the suspected agent process, used by Komari for Inter-Process Communication (IPC) and routing shell output. The rule correlates NamedPipeEvent with DeviceNetworkEvents to ensure the initiating process also has network activity to a remote IP, and specifically looks for named pipes matching a regex pattern often used by Komari.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
This rule detects attempts to bypass AMSI (Antimalware Scan Interface) by overwriting the AmsiScanBuffer function in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events where the target address is within the memory region of 'amsi.dll', indicating a potential in-memory patch to disable endpoint telemetry.
Detects the creation of a new local user account followed by its immediate addition to the local Administrators group, indicative of potential privilege escalation or persistence by an attacker.
Page 991 of 1168