Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,411 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects malicious persistence activity on Android devices originating from an ADB or shell context (UID 2000). The rule monitors for a sequential pattern: the silent re-installation of the 'RatHat' APK package via 'pm install' commands, followed by the modification of system security settings to re-grant Accessibility Service permissions.
Detects the sequential activation of Android Accessibility services followed by Device Administrator activation by the same application within a short timeframe. This behavior is indicative of sophisticated Android malware, such as RatHat, establishing persistence and preventing uninstallation by combining Accessibility-based control with Device Admin-based device management capabilities (e.g., remote wipe or anti-uninstall).
Detects the staging of a potential RatHat malware component by observing a native Go binary being moved into /data/local/tmp via ADB shell (uid 2000), followed by an associated service binding to local port 7912 within a 5-minute window. This sequence is characteristic of the deployment process for this specific Android threat.
This rule detects unauthorized attempts to create privileged containers via the Docker API, specifically identifying the use of the 'net-setup' string often associated with the CARBONATO worm. Such activity indicates potential propagation or lateral movement within a containerized environment by attempting to deploy containers with elevated permissions.
Detects the execution of the XMRig cryptominer masquerading as the legitimate systemd-logind service. The rule identifies suspicious command-line arguments indicative of mining activity, or instances where systemd-logind is spawned from unauthorized parent processes such as shell interpreters, container engines, or nsenter, which is often characteristic of post-exploitation activity like privileged Docker container escapes.
Detects unauthorized access to unauthenticated Docker registry API endpoints on port 5000. This rule identifies catalog enumeration and the pulling of malicious container images associated with the CARBONATO botnet, including the retrieval of image manifests and configuration files that expose sensitive environment variables and credentials.
Detects persistence mechanisms used by the CARBONATO botnet on Linux-based Docker hosts. The rule monitors for the application of immutable file attributes using 'chattr +i' on identified watchdog binaries (specifically '.docker-network-monitor'), the creation of malicious cron jobs, the enabling of suspicious systemd timers ('docker-network-resolver'), and the execution of specific persistence-related shell scripts.
Detects the deployment and operational artifacts associated with the Hermes Agent framework using the CARBONATO GH0ST persona on Linux systems. This detection focuses on identifying specific file-system indicators, including persona configuration files (SOUL.md), loot staging directories, and deployment entry scripts (entry.sh or CARBONATO_API_KEY artifacts) that indicate malicious activity and potential AI-driven Telegram command and control (C2) staging.
Page 121 of 1168