ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,088 copies12 likes3,491 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects network connections to the npm registry (registry.npmjs.org) initiated by AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, Aider) or by unexpected processes that are not standard package managers or browsers.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects endpoint network connections and correlates multi-stage communications associated with the ClickFix browser cache smuggling campaign, including initial payload retrieval and secondary stage/C2 communication across devices.
Detects outdated or vulnerable installations of GitLab and Ruby across devices using TVM software inventory, software vulnerabilities, process events, and file events, checking against known fixed versions for specific CVEs.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects the presence of Tailscale binaries (tailscale.exe, tailscaled.exe) on a device within 24 hours of other campaign-specific toolkit components such as kitanai.exe, nandemo.exe, ufw.exe, or upd-ms.bat, indicating potential unauthorized remote access setup.
Detects indicators of compromise including Bash-based reverse shells communicating with a C2 domain on port 7070, outbound network connections from web server and shell processes to the same C2 infrastructure, and the dropping of known suspicious plugin archive files (akismetv4-plugin.zip, Hlx.zip, template.zip).
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
Page 11 of 35