Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,247 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects various reconnaissance techniques commonly used to identify network resources, including the execution of SoftPerfect Network Scanner (or renamed binaries), the creation of 'delete.me' files used by SoftPerfect to probe share permissions, the usage of the 'Invoke-ShareFinder' PowerShell script, and the enumeration of network shares using 'net.exe' initiated from PowerShell.
Detects suspicious module loads (DLLs) by the Windows Consent UI process (consent.exe) or from an application installation folder in the temporary directory. This pattern is indicative of potential DLL side-loading or hijacking, where an adversary places a malicious DLL in an unexpected location to be loaded by a legitimate process.
Detects network connections to the typosquatted domain 'perplexity-ai.online', associated with a malicious browser extension used for data exfiltration. Additionally, it detects the creation or modification of 'background.js' files within common web browser extension directories, which is a common persistence mechanism for malicious extensions.
Detects anomalous child process creation or .lnk file interaction by the LunarClient process. This rule monitors for indicators of potential supply chain compromise or malicious activity where the gaming client spawns shells, scripting interpreters, or network utilities, or generates shortcut files to facilitate further execution.
This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.
Detects potentially unauthorized or malicious behavior associated with the RustDesk remote access tool. The rule monitors for unsigned screen capture attempts, spawning of shell or scripting processes, cross-process input injection, and network communication over non-standard or unexpected ports.
Detects artifacts and behaviors associated with a malicious Chromium extension identified as 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for unauthorized extension installation, registry modifications to the browser's default search provider settings pointing to a suspicious domain (perplexity-ai.online), and outbound browser network traffic or DNS queries directed toward the same domain for potential data exfiltration.
Detects the execution of known CVE-2026-55200 exploit harness and server binaries, or the creation of the libpwn_rce_proof.txt artifact. These activities indicate active exploitation staging or the successful execution of an out-of-bounds heap write exploit chain against libssh2.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
Page 998 of 1168