Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,054 copies47 likes38,395 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying outbound HTTP POST requests to the '/api/t' URI path occurring on non-standard ports. The detection utilizes a threshold-based trigger to identify potential C2 communication heartbeats.
Detects anomalous, high-frequency outbound network connections to port 443 initiated by the binary 'rnpkeys.exe'. This behavior is characteristic of the Sauron Loader, which uses this masqueraded process to exfiltrate collected data, such as screenshots, via an encrypted C2 channel.
Detects various system utilities executing files or payloads staged in user-specific temporary directories (%AppData%\Local\Temp). This pattern is consistent with malware loaders (such as the Sauron Loader) that write payloads to the Temp folder before utilizing trusted Windows binaries (LOLBins) like rundll32, regsvr32, powershell, or wscript for execution. It also tracks potential driver installation or direct process memory access attempts from the same location.
Detects a sequence of events where a single user receives an unusually high volume of inbound emails (potentially vishing-related), followed shortly thereafter by the user executing common remote assistance or remote access tools (e.g., Quick Assist, AnyDesk). This pattern is consistent with social engineering tactics used in IT-support impersonation scams to facilitate the delivery of malware such as Sauron Loader.
This rule detects network activity involving specific domain names (e.g., velvet-otter-glagceis.life) or HTTP request patterns associated with malicious JavaScript or trackers, which may indicate C2 communication or malicious script loading.
Detects the execution of various system binaries (e.g., rundll32.exe, powershell.exe, regsvr32.exe) launched from a Temp directory where the parent or actor process is identified as rnpkeys.exe or rnp.dll. This behavior is indicative of potential malicious activity where legitimate tools or utilities (GnuPG/RNP) are being abused to proxy the execution of secondary payloads or scripts.
Detects instances where attrib.exe is executed with minimal or no command-line arguments, launched by processes other than standard Windows shell processes like cmd.exe, explorer.exe, or powershell.exe. This pattern is often indicative of potential masquerading, where malicious binaries are renamed to mimic legitimate Windows system utilities to evade detection.
This rule detects potentially malicious C2 communication by monitoring high-frequency HTTP POST requests from the 'rnpkeys.exe' process. It aggregates network events over 30-second windows and flags activity exceeding a threshold of 5 POST requests directed at known suspicious domains or specific high-port network destinations, which is characteristic of beaconing or data exfiltration activity.
Detects suspicious AI agent behavior by identifying two primary scenarios: 1) The invocation of sensitive tools (e.g., code execution, file deletion) within a short timeframe following a flagged prompt injection or jailbreak attempt in the same conversation; or 2) The invocation of a tool by an AI agent that is not explicitly defined in its allowed tool list for the given workflow.
This rule detects potential Denial of Service (DoS) attacks against AI inference endpoints. It monitors for sustained high latency and high error rates combined with a high volume of 'heavy' requests (those exceeding a token/character count threshold) from specific source IPs. This pattern suggests an attempt to exhaust system resources by forcing the processing of complex or overly large prompts.
Page 106 of 1168