Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,247 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Detects first-time external sender domains delivering multiple voicemail-themed or financial urgency emails to the same recipient during off-hours (midnight-06:00 UTC), consistent with Scotiabank TOAD callback phishing targeting CFO/finance executives.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects suspicious execution of MpCmdRun.exe (Windows Defender command-line utility) when it is spawned by an unexpected parent process or executed with arguments commonly used to disable or modify Windows Defender's functionality. This rule aims to identify attempts to impair defenses.
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
Detects the creation of hidden Python virtual environments (.venv, .pip) in user directories used to cleanly execute OpenClaw and GhostSocks without system dependencies. This rule specifically looks for 'python.exe' executing with the '-m venv' argument followed by a hidden directory name (starting with a dot) and joins this with file events indicating a folder creation.
This rule detects the execution of a user-mode EDR Killer executable from common temporary or public directories (Temp or Public) immediately preceding the creation of a known ransomware or payload file (executable, MSI, batch, or PowerShell script). The detection logic looks for process command lines containing keywords like '-kill', '-bypass', or '-edr' for the EDR Killer, followed by a file creation event within a 5-minute window on the same device.
Detects the ClickFix clipboard execution (Get-Clipboard or iex) triggered from explorer.exe, specifically leading to the download of the Matanbuchus DLL.
This rule detects a classic malicious model attack chain where a Python process reads a .pkl, .pt, or .bin model file, and immediately spawns an anomalous system shell or execution utility. This indicates potential Remote Code Execution (RCE) via deserialization vulnerabilities in machine learning models.
Page 994 of 1168