Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,289 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects administrative changes to Cisco SD-WAN environments, including policy pushes, template attachments, device onboarding, and tunnel modifications. It uses a risk-scoring mechanism based on the type of change and whether the activity occurs outside of standard business hours (06:00 to 22:00). High-risk events (score >= 65) trigger an alert, highlighting potential unauthorized infrastructure modifications or malicious device insertion.
Detects the installation of a Microsoft Edge extension followed by an outbound network connection to known StegoAd C2 infrastructure after a 3-5 day dormancy period, a behavior characteristic of time-gated sandbox evasion.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
This rule detects potentially malicious activity involving System Informer (formerly Process Hacker) or its associated service (phsvc) spawning suspicious child processes like cmd.exe or using rundll32.exe to execute specific DLL-based proofs-of-concept. These patterns are often associated with privilege escalation or evasion techniques using these tools' service drivers.
Detects the execution of common Linux binary inspection and utility tools (ldd, strings, readelf, objdump, nm) when referencing libssh2, potentially indicating an attacker's reconnaissance effort to analyze libraries for vulnerabilities or reverse engineer SSH-related functionality.
Detects modifications to the Windows Registry 'AutoConfigURL' setting under 'Internet Settings' initiated by the OpenVPNConnect.exe process. This registry key controls the automatic proxy configuration (PAC file) for the system or user, which can be abused by adversaries to redirect network traffic through a malicious proxy server.
Detects instances where the RustDesk remote access application spawns common system administrative or command-line tools. This behavior is highly indicative of potential abuse of remote desktop software by an attacker to maintain persistent control, execute commands, or perform reconnaissance on a compromised system.
Detects the execution of container-related binaries (act_runner, docker, dockerd) using sensitive command-line flags that indicate potential container escape or high-privilege configuration, such as mounting the host namespace, running in privileged mode, or leaking CI/CD tokens.
This rule detects the presence of specific file names, paths, or command line arguments associated with a known penetration testing or exploit harness tool (libpwn). These artifacts are indicative of potential security testing or exploit activity on the host.
Detects unusual SSH activity originating from or involving Cisco vManage systems, specifically monitoring outbound SSH connections to internal network segments (10.0.0.0/8) or the execution of SSH processes with command-line arguments indicative of management tasks (vsmart, vbond).
Page 997 of 1168