Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,149 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects the execution of various AI coding assistant and CLI tools (such as Claude, Codex, Cursor, and Gemini) where the binary path or command line indicates execution from a Downloads folder, which is a common indicator of user-downloaded utilities running without proper installation.
Detects instances where googleupdate.exe is executed or loads DLLs from outside the legitimate Program Files paths, or correlates with v8_context_snapshot.bin file access within a 10-minute window, potentially indicating Google Update binary masquerading or side-loading.
Detects the creation or modification of a .jxl file by a web browser, email client, or chat application in download or temp directories, followed closely by the execution of ffmpeg referencing the .jxl file within a 15-minute window.
Detects process creation of data exfiltration tools (Rclone, MEGAsync, WinSCP) and archive utilities (7z, rar) used with staging and compression arguments, which represents a common pre-ransomware data staging and exfiltration pattern.
Detects quick reconnaissance commands (such as whoami, id, uname, ipconfig) executed directly by a web server worker (e.g., PHP-FPM, Apache httpd) or via a shell child process of the web server worker, indicative of post-exploitation activity like php2shell.
Detects file creation, modification, or renaming in EFI boot paths (such as \EFI\Boot\ or \EFI\Microsoft\Boot\) by processes other than standard Windows OS servicing components like TrustedInstaller.exe or setup.exe. This activity is indicative of bootkit installation or persistence establishment via the EFI system partition.
Detects execution of the Tailscale CLI enabling or disabling Tailscale SSH using the set or up commands with the --ssh parameter, excluding known administrative tools.
Detects the tailscaled process communicating with cloud instance metadata endpoints (169.254.169.254, 169.254.170.2) or Kubernetes API/kubelet ports (6443, 10250), which may indicate app connector abuse or unauthorized internal resource enumeration.
Detects the execution of Tailscale with commands indicating the use of 'serve' or 'funnel' features, potentially establishing unauthorized network tunnels or proxies.
Detects instances where the tailscaled or tailscale process accesses sensitive system files such as /etc/shadow or Docker/Tailscale Unix sockets.
Page 6 of 9