Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,286 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects DNS requests initiated by the Microsoft Edge browser (msedge.exe) to a specific list of domains identified as potentially malicious or associated with unauthorized activity. It monitors and aggregates these requests to provide visibility into potential command and control or unauthorized communication attempts.
Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.
Detects the execution of RustDesk, a legitimate remote access tool, specifically when running with service or tray command-line arguments. This activity may indicate the installation of remote management capabilities by an adversary or authorized administrative activity.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
Detects HTTP requests that include an 'Upgrade' header (specifically for websocket or h2c) in conjunction with a 'Content-Length' header. This combination can be used to perform HTTP Request Smuggling or protocol-specific request queue poisoning attacks, particularly against load balancers or proxy servers like nghttpx.
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
Page 996 of 1168