Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,155 downloads5,579 copies42 likes29,871 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects the creation or modification of potentially malicious files such as autorun.inf or scripts (.lnk, .vbs, .hta, .bat, .cmd, .ps1) on removable or network drive letter paths (D-Z). This activity is indicative of attempts to facilitate malware execution via removable media, bypassing standard system binaries by excluding Microsoft-signed processes.
This rule detects suspicious activity on Linux endpoints related to the execution of files named 'isp.sh' or 'lambsys', as well as potential file downloads from a known malicious IP address. It monitors process creations and file creations involving these specific artifacts, as well as common attack patterns such as piping web-downloaded content directly to a shell.
Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.
This rule detects a sequence of events where a new local account is created on a device using common administrative commands (net user, PowerShell New-LocalUser), followed within 60 minutes by the execution of known offensive security tools or frameworks such as Impacket, NetExec, CrackMapExec, Chisel, or Havoc agent on the same device. This pattern is indicative of potential unauthorized system access, staging of persistence mechanisms, or active reconnaissance activities.
Detects reconnaissance activity where PowerShell scripts named 'lightlife.ps1' or 'Update.ps1' execute common Windows system information discovery commands such as systeminfo, whoami, hostname, and wmic. This activity is indicative of the Lightlife RAT performing post-exploitation host enumeration.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. The detection monitors for the presence of specific keywords and method calls in script content, such as 'AmsiUtils', 'amsiInitFailed', and reflection-based attempts to modify memory buffers used by AMSI to scan for malicious scripts.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Page 1000 of 1168