Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,420 downloads7,048 copies47 likes38,247 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Detects HTTP/1.1 Upgrade requests directed at an nghttpx proxy that contain a non-zero Content-Length header. This combination is the core primitive for the nghttp2-nghttpx-upgrade-queue-poison-poc attack, where the proxy incorrectly forwards request body bytes to the next backend connection user.
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
This rule detects various stages of exploitation activity associated with the System Informer PHSVC (Process Hacker Service) proof-of-concept (PoC). It monitors for the loading of the PoC DLL via rundll32, the spawning of processes using the specific PoC marker string, unexpected elevated child processes spawned by SystemInformer.exe, and the creation of services or PoC artifacts that facilitate privilege escalation or persistence.
This rule monitors for suspicious activity associated with Flowise Model Context Protocol (MCP) implementations, specifically detecting environment variable bypasses using Node.js --require, potential Server-Side Request Forgery (SSRF) attempts targeting internal infrastructure and cloud metadata services, and the creation of known proof-of-concept (PoC) artifacts.
Detects potential HTTP Request Smuggling attempts targeting the nghttpx reverse proxy by monitoring for HTTP/1.1 'Upgrade: h2c' requests that include a 'Content-Length' header, or traffic containing known PoC-specific payloads, poisoned paths, or specific nghttp2 version strings that indicate exploitation activity.
Page 999 of 1168