Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Identifies the threat actor dropping web shell files (.aspx, .php, .jsp) directly into the BeyondTrust/Bomgar application directories to establish persistent web-based access.
Detects vLLM processes spawning common reverse shell binaries, indicating potential exploitation of CVE-2026-22778.
Detects AutoGen Studio spawning Living-off-the-Land binaries (LOLBins) used for execution or payload retrieval. This rule specifically looks for processes initiated by 'autogenstudio' that then execute 'certutil.exe', 'mshta.exe', 'regsvr32.exe', or 'rundll32.exe'.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
Identifies Nightspire utilizing bcdedit.exe to modify boot configuration data, explicitly ignoring all boot failures and disabling the Windows recovery environment.
This rule detects instances where 'autogenstudio' is the initiating process for spawning common Unix shells (bash, sh, dash, wsl.exe). This activity is indicative of the AutoJack Remote Code Execution (RCE) vulnerability.
KQL Query from file: AutoJack_RCE_-_AI_Agent_Browsing_Untrusted_Domains.kql
This rule detects attempts to disable Microsoft Defender's real-time monitoring or behavior monitoring features using PowerShell. It specifically looks for `powershell.exe` executing `Set-MpPreference` with the `-DisableRealtimeMonitoring` or `-DisableBehaviorMonitoring` parameters set to `1`, `$true`, or `True`.
Detects the execution of osascript used to generate deceptive "Network latency" GUI prompts, tricking the user into granting TCC permissions.
Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.
Page 992 of 1168