Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,054 copies47 likes38,395 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where 'rnpkeys.exe', residing within a 'keyroll' directory, initiates suspicious child processes or executes suspicious command lines. This includes triggering common scripting engines like PowerShell or cmd.exe, using execution policy bypass flags, or executing binaries from Temp directories, which are characteristic of malicious post-exploitation or persistence activities.
Detects specific malicious Mach-O binary payloads associated with the Atomic macOS Stealer (AMOS) discovered in the Macfinger ClickFix campaign. The rule uses static file hashes to identify these specific samples.
Detects an outbound network connection initiated by 'rnpkeys.exe' when executing from a non-standard 'ProgramData\keyroll' directory. This behavior is associated with the early stages of a Command and Control (C2) registration sequence, where an encrypted loader initiates network contact before subsequent staged communication.
Detects adversaries attempting to override LLM system instructions by submitting crafted prompts containing known injection patterns (e.g., 'ignore previous instructions', role-override). The rule tracks anomalous interaction patterns identified by multiple occurrences or a variety of override phrases within a short timeframe.
Detects the ingestion of documents into production RAG (Retrieval-Augmented Generation) indexes from untrusted or external-facing sources, which may indicate an attempt to perform RAG poisoning attacks.
This rule detects potential cost harvesting or service abuse against AI gateway endpoints. It establishes a baseline of typical user activity over a 30-day period and flags anomalies where current request volume (in the last 1 hour or 24 hours) significantly exceeds the user's established P95 baseline. To reduce noise, it specifically identifies scenarios where these high-frequency requests are associated with low-complexity, short prompts, which are indicative of automated probing or resource-intensive scraping rather than legitimate high-utility usage.
This rule detects anomalous behavior in AI agent tool invocations, specifically monitoring for high volumes of tool calls, high costs associated with token consumption, or suspicious tool interactions following a flagged indirect prompt injection. This behavior is indicative of potential resource exhaustion (denial of service) or abusive agent behavior as defined by the MITRE ATLAS framework for AI security.
Detects execution of staged payloads within the %TEMP% directory initiated by processes associated with the Sauron Loader (rnpkeys.exe or processes running from ProgramData\keyroll). The rule monitors for common living-off-the-land binaries (rundll32.exe, regsvr32.exe, msiexec.exe, cmd.exe, powershell.exe, wscript.exe) acting as task handlers for the loader.
Detects specific malicious Mach-O binary payloads identified as Atomic Stealer (AMOS) that are associated with Macfinger ClickFix first-stage infection campaigns. The rule uses static file signatures (Mach-O headers), specific file size ranges, and known SHA-256 hashes of the payloads.
Detects a specific social-engineering pattern known as 'ClickFix' where a user is manipulated into opening the Windows Run dialog (explorer.exe) to manually execute commands. The rule identifies suspicious command-line arguments typically associated with initial access (e.g., PowerShell hidden/encoded execution, web downloads) followed by the execution of MSI installers or related malicious binaries (e.g., rnpkeys.exe) within a 30-minute window, indicative of the Sauron Loader infection chain.
Page 105 of 1168