gaurang k
@gaurang77780 followers0 downloads21 copies1 like66 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
4
4
2
1
1
Platforms
4
1
Products / Services
2
2
1
1
MITRE Techniques
2
1
1
1
1
Detects suspicious execution of system commands (curl, wget, python, bash, etc.) by AI/ML-related server processes like LiteLLM, RAGFlow, or Kestra. The detection looks for command-line arguments that may indicate credential harvesting, such as attempts to access environment variables, sensitive database configuration files, or the use of encoded data/network retrieval tools.
This rule detects the use of command-line text-processing utilities (grep, awk, sed, etc.) to search for sensitive credential-related strings (e.g., secret, token, password) within environment files or process environments. This pattern is indicative of an adversary attempting to manually extract stored credentials from configuration files or system environment variables.
Detects the execution of commands containing keywords associated with Linux kernel module management (modprobe) and sensitive memory/kernel modification flags (msr, allow_writes). These keywords are often utilized by malicious actors attempting to load Loadable Kernel Modules (LKMs), manipulate system memory directly, or disable kernel-level protections.
This rule detects common command-line utilities (cat, bash, sh, python, grep) being used to access the '/proc/1/environ' file. This file contains environment variables for the PID 1 process (typically the init system), which may include sensitive information such as credentials, configuration paths, or system secrets.