Mayur Aditya Bollaboina
@cynik1 follower67 downloads79 copies0 likes2,929 views
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Categories
3
2
1
1
1
Platforms
6
3
1
Products / Services
2
1
1
1
1
MITRE Techniques
4
4
3
2
2
CVEs
1
High-confidence detection for probable Copy Fail exploitation requiring AF_ALG or algif_aead references, syscall-style splice usage, and privileged binary targeting. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py https://xint.io/blog/copy-fail-linux-distributions#how-we-found-it-9
This rule detects Windows devices running an antivirus platform version that is not '4.18.26030.3011'. This could indicate an outdated antivirus installation, which might be a result of defense evasion tactics or a failure in update mechanisms, leaving the system vulnerable.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
Detects creation of known malicious files linked to axios compromise
Detects Node.js making outbound connections to suspicious domains or IPs
Detects Node.js spawning shell processes which may indicate malicious npm package activity
Detects execution of processes from node_modules which may indicate malicious package behavior