Subash Ghimire
@iamsubashgTrusted contributorCompletionist
6 followers244 downloads631 copies17 likes8,299 views
92 detections
Filters
Last updated
All Time
Detection languages
92
Categories
14
11
11
7
6
Platforms
42
13
9
8
6
Products / Services
36
10
7
5
3
MITRE Techniques
21
18
18
16
14
CVEs
3
3
1
1
1
CVE-2026-41089 is a stack-based buffer overflow vulnerability located within the Windows Netlogon service (netlogon.dll). Netlogon is a core Authentication Service component that maintains the secure channel (Schannel) between domain-joined computers and Domain Controllers (DCs) for user authentication.
CVSSv3: 9.8
Impacts:
Because the Netlogon service runs as SYSTEM (or effectively within lsass.exe which has SYSTEM privileges), any code executed via this exploit inherits those permissions. This allows the attacker to:
Install malicious services or persistence mechanisms.
Dump the NTDS.dit database (all credential hashes).
Create Golden Tickets (Kerberos Ticket Granting Tickets) for total domain persistence.
CVSSv3: 9.8
Impacts:
Because the Netlogon service runs as SYSTEM (or effectively within lsass.exe which has SYSTEM privileges), any code executed via this exploit inherits those permissions. This allows the attacker to:
Install malicious services or persistence mechanisms.
Dump the NTDS.dit database (all credential hashes).
Create Golden Tickets (Kerberos Ticket Granting Tickets) for total domain persistence.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
An unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
Detects PowerShell downloading and executing remote payloads using invoke-restmethod/irm and invoke-expression/iex. This technique is widely used by ClearFake and PS1Bot malvertising campaigns to execute in-memory payloads directly from C2 servers.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
CVE-2026-42945, dubbed "NGINX Rift," is a critical (CVSS 9.2) heap buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Open Source, NGINX Plus, and related products. It is triggered when a specific rewrite configuration pattern—using an unnamed PCRE capture (e.g., $1) with a replacement string containing a question mark (?)—is combined with a subsequent rewrite, if, or set directive. Exploitation can lead to reliable worker process crashes (Denial of Service) and, under certain conditions such as disabled ASLR, unauthenticated Remote Code Execution (RCE)
"Dirty Frag" is a highly reliable Linux kernel privilege escalation vulnerability that exploits logical defects in the splice system calls combined with the xfrm-ESP or RxRPC protocol stacks. By executing these flaws, local attackers can tamper with the page cache of read-only files (such as /etc/passwd or /usr/bin/su) to gain root privileges or execute container escapes without relying on race conditions.
These vulnerabilities are particularly dangerous for defenders because they manipulate memory data (page cache) without permanently altering the underlying disk files, rendering traditional disk-based file integrity monitoring tools ineffective at detecting the exploit in real-time.
Affected Linux Kernel Module:
ESP (IPsec) modules
esp4
esp6
2. RxRPC module
Linux kernel module for:
Remote procedure calls (AF_RXRPC protocol)
These vulnerabilities are particularly dangerous for defenders because they manipulate memory data (page cache) without permanently altering the underlying disk files, rendering traditional disk-based file integrity monitoring tools ineffective at detecting the exploit in real-time.
Affected Linux Kernel Module:
ESP (IPsec) modules
esp4
esp6
2. RxRPC module
Linux kernel module for:
Remote procedure calls (AF_RXRPC protocol)
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
Page 2 of 10