Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized attempts to interact with the Docker API to create containers or pull images, specifically looking for patterns associated with the CARBONATO worm which utilizes the /containers/create endpoint with 'net-setup' parameters.
Detects incoming HTTP POST requests to the Docker API endpoint '/containers/create' containing 'Privileged: true' and a bind mount to the host filesystem ('/:/host'). This pattern is indicative of an attempt to deploy a privileged container with host access, which can be leveraged for container breakout or host system compromise.
Detects the presence of the 'SOUL.md' configuration file associated with the Hermes Agent AI framework. This file contains a specific 'GH0ST' persona prompt designed to bypass ethical restrictions (jailbreak) and configure the agent for automated post-exploitation tasks, such as loot collection and Telegram-based command and control.
Detects evidence of persistence mechanisms associated with the CARBONATO botnet on Linux systems. This includes the application of chattr +i to the malicious watchdog binary, the execution of the auto-persist-host.sh script, the enabling of the docker-network-resolver systemd timer, or modifications to crontab for watchdog execution.
Detects instances where the XMRig cryptominer is masquerading as the legitimate systemd-logind process on Linux hosts. The rule triggers on process execution of /usr/sbin/systemd-logind coupled with suspicious outbound network connections to known mining pools or mining-related ports.
Detects the creation of files containing AI provider API keys within the /root/.hermes/loot/ directory, consistent with credential harvesting behavior observed by the CARBONATO GH0ST agent.
Detects anomalous database activity on Magento e-commerce platforms where a SELECT operation against sensitive payment-related tables is followed by a DELETE operation on the same table within the same host context. This sequence is indicative of an attacker exfiltrating credit card data and subsequently attempting to remove forensic evidence of the theft.
Detects a coordinated attack sequence where a browser process is terminated, followed immediately by the execution of an unsigned Python interpreter from a suspicious location (temp/downloads folder), which is then followed by the installation of an unsigned browser extension. This pattern mimics ClickFix and browser-based RAT lure campaigns.
Detects the CLOSEDQUORUM implant communicating with multiple LLM providers (DeepSeek, Qwen, Mistral, or Gemini) for quorum-based decision making, followed by the same process spawning or injecting into a legitimate Windows system process (e.g., svchost, explorer) to conduct post-exploitation activities.
Detects potential process injection attempts where a process is created in a suspended state (often used for hollowed or injected code) and subsequently performs sensitive remote memory or thread operations (e.g., NtAllocateVirtualMemoryRemote, WriteProcessMemoryRemote) on that process.
Page 119 of 1168